National Data Guardian for Health and Social Care
An independent, non-regulatory advisory body on the confidentiality, security and appropriate use of health and adult social care data in England.
Last updated August 26, 2026
AI crawler reads
No AI crawler has read this profile since Oct 28, 2026.
Overview
The National Data Guardian for Health and Social Care is an independent, non-regulatory advisory body sponsored by the United Kingdom Department of Health and Social Care. Its remit is focused on England's health and adult social care system, where it advises ministers, public bodies and the wider care system on how confidential information should be protected and used. The body addresses the balance between privacy and the legitimate benefits of data use, including direct care, service improvement, research, planning and population health. The role began on a non-statutory basis in November 2014, with Dame Fiona Caldicott as the first National Data Guardian. Caldicott had already played a central role in UK policy on patient-identifiable information through the original Caldicott Report of 1997 and a second review published in 2013. Her work as National Data Guardian extended those principles into questions of digital security, information governance, consent and public choice over secondary uses of confidential data. A major early output was the Review of Data Security, Consent and Opt-outs, commissioned in 2015 by the Secretary of State for Health and published in July 2016. Prepared with the Care Quality Commission, the review proposed ten national data-security standards, a mechanism for assessing compliance and a new model allowing patients to opt out of certain uses of their confidential information. The recommendations were accepted in the government's 2017 response, Your Data: Better Security, Better Choice, Better Care. They contributed to the creation of the national data opt-out system, launched by NHS Digital in May 2018, and formed part of the policy response to concerns surrounding the care.data programme. Parliament placed the office on a statutory footing through the Health and Social Care (National Data Guardian) Act 2018, which received Royal Assent on 20 December 2018. The legislation gave the National Data Guardian formal advice-giving powers concerning the processing of health and adult social care data in England. It did not turn the office into a regulator. The National Data Guardian cannot impose sanctions or directly enforce compliance, and instead works alongside bodies such as the Information Commissioner's Office and the Care Quality Commission. Dame Fiona Caldicott became the first statutory holder of the office in March 2019 and remained in post until her death in February 2021. Dr Nicola Byrne was appointed in March 2021 by the Secretary of State for Health and Social Care. Under the office's continuing model, the National Data Guardian provides advice, scrutiny and challenge rather than operational health or social care services. Its principal outputs are reviews, guidance, recommendations and public-policy interventions concerning confidentiality, information security, transparency, consent and choices about data use.
History
The National Data Guardian for Health and Social Care was created in November 2014 as a non-statutory office intended to provide independent advice on the handling of confidential information in health and social care. Dame Fiona Caldicott was appointed to lead the role. Her appointment built on a long-standing policy tradition associated with the Caldicott principles, which originated in the 1997 Report on the Review of Patient-Identifiable Information. A further review, commonly known as Caldicott 2, followed in 2013 and examined the protection and use of patient information in a changing digital environment. The office's work developed during a period of heightened public and institutional concern about electronic records, data sharing, cyber-security and the use of patient information beyond direct care. In September 2015, the Secretary of State for Health asked the National Data Guardian and the Care Quality Commission to conduct a formal review of data security, consent and opt-outs. The resulting report, published in July 2016, set out twenty recommendations. Among its central proposals were ten national data-security standards for health and care, a way to test organisations against those standards, and a revised approach to consent and patient choice in relation to confidential information. The Care Quality Commission published its related Safe Data, Safe Care report alongside the National Data Guardian's review. The government's 2017 response, Your Data: Better Security, Better Choice, Better Care, accepted the recommendations and described implementation plans. These plans included a national data opt-out system, which NHS Digital launched in May 2018. The review and subsequent policy work also formed part of the wider response to the care.data programme, which was ultimately closed by NHS England. The office became statutory through the Health and Social Care (National Data Guardian) Act 2018. The legislation received Royal Assent on 20 December 2018 and established formal advice-giving powers in relation to the processing of health and adult social care data in England. It preserved the office's advisory character: the National Data Guardian is not a regulator and does not impose sanctions. Enforcement and regulatory intervention remain matters for bodies such as the Information Commissioner's Office and the Care Quality Commission. Dame Fiona Caldicott became the first statutory National Data Guardian in March 2019. She held the position until her death in February 2021. Dr Nicola Byrne was appointed to succeed her in March 2021. The office continues to advise and challenge government and health and social care organisations on confidentiality, security, transparency, public trust, data sharing and the appropriate use of information to support care and improve outcomes.
- 2021
Dr Nicola Byrne appointed
[1]Dr Nicola Byrne became National Data Guardian in March after Dame Fiona Caldicott's death.
- 2019
First statutory National Data Guardian appointed
[1]Dame Fiona Caldicott took up the statutory version of the office in March.
- 2018
Health and Social Care (National Data Guardian) Act receives Royal Assent
[1]The Act became law on 20 December and gave the office formal advice-giving powers.
- 2018
National data opt-out launched
[1]NHS Digital launched the national data opt-out system in May, following the government's acceptance of recommendations from the 2016 review.
- 2016
Review of Data Security, Consent and Opt-outs published
[1]The review issued twenty recommendations, including ten national data-security standards and a new model for patient choice.
- 2015
Formal review commissioned
[1]The Secretary of State for Health asked the National Data Guardian and Care Quality Commission to review data security, consent and opt-outs.
- 2014
National Data Guardian role established
[1]The office began operating on a non-statutory basis in November, with Dame Fiona Caldicott as its first holder.
- 2013
Second Caldicott review published
[1]A further review examined safeguards for patient information and the changing requirements of digital health and care systems.
- 1997
First Caldicott Report published
[1]The Report on the Review of Patient-Identifiable Information established an important foundation for later UK guidance on protecting and using confidential patient information.
Products and positioning
An independent public-interest adviser and critical voice on the safe, secure and proportionate use of health and adult social care information. It operates between government policy and the health and care system, offering advice and challenge while leaving enforcement to established regulators.
Product categories. Independent reviews of health and social care data governance · Guidance and recommendations on confidentiality, information security and patient choice · Advice to government and health and adult social care organisations · Public-facing policy analysis on the use of confidential health and care information
Brand decisions
2018
Support statutory establishment of the National Data GuardianOtherBackground
The office had operated since 2014 on a non-statutory basis, limiting the formal status of its advice and functions.
Action taken
Parliament enacted the Health and Social Care (National Data Guardian) Act 2018, which received Royal Assent on 20 December and placed the role on a statutory footing.
Aftermath
The National Data Guardian acquired formal advice-giving powers concerning the processing of health and adult social care data in England, while remaining non-regulatory and unable to impose sanctions.
2016
Recommend national data-security standards and a new opt-out modelStrategyBackground
The National Data Guardian and Care Quality Commission were asked to examine weaknesses and public concerns relating to data security, consent and the use of confidential patient information.
Action taken
The National Data Guardian's review proposed twenty measures, including ten national data-security standards, a compliance-testing approach and a revised system of patient choice over certain secondary uses of confidential data.
Aftermath
The government accepted the recommendations in 2017. The work contributed to the national data opt-out launched by NHS Digital in May 2018 and to the closure of the care.data programme by NHS England.
Sources2 sources
Cite this profile: Cite the canonical profile. /brand-wiki/national-data-guardian-for-health-and-social-care · Editorial policy · How profiles are compiled