Adopters - Complying with the UK GDPR Steps 1 - 7: an introduction- Step 7: Follow the 8 Caldicott Principles

Reviewed by: Health and Care IG Panel

Follow the 8 Caldicott Principles that make sure people's information is kept confidential and used appropriately.

Caldicott Guardians help their organisations make sure confidential information about health and social care is used ethically, legally and appropriately. Caldicott Guardians should provide leadership and informed advice on complex matters involving the use and sharing of patient and service user confidential information, especially in situations where there may be areas of legal or ethical ambiguity.

For more information about the types of organisations that should have a Caldicott Guardian, see the National Data Guardian guidance on appointment of Caldicott Guardians. If your organisation does not have a Caldicott Guardian, you can contact the UK Caldicott Guardian Council: ukcgcsecretariat@nhs.net.

Important note: if you originally collected the data but you did so on the basis of UK GDPR consent, you would normally need to get new consent before you repurposed the data. This is to make sure your new processing is fair and lawful. You also need to update your privacy information to make sure that your processing is still transparent.

Get more information:

Read about purpose limitation in ICO’s guide to the GDPR, and see ICO's guidance on research provisions.