Paul Garlick: Why I became a Caldicott Guardian

One of the questions I’m occasionally asked is, “Why does someone choose to become a Caldicott Guardian?” It’s usually delivered with a mixture of curiosity and sympathy, because from the outside the role can appear to be about risk, ambiguity, and difficult decisions. In many ways, that perception isn’t entirely wrong, but it isn’t the whole picture either.

A Caldicott Guardian is a senior person responsible for protecting the confidentiality of individuals’ health and care information and ensuring it is appropriately used. Whilst that description is accurate, it doesn’t fully capture the lived reality of the role. In practice, the work is less about policy and more about judgement.

Day to day, the role sits at the heart of seemingly competing pressures: protecting privacy while protecting people, enabling care while managing risk, and supporting professionals who are themselves navigating complex decisions. These priorities rarely align neatly, particularly in safeguarding contexts where circumstances are fluid and certainty can be elusive.

From my 21 years of experience in local government, I know that information governance is sometimes seen as a technical or legal discipline. In safeguarding environments, however, it rarely feels that way. Decisions about information are, basically, decisions about people – about vulnerability, risk, and the potential consequences of something important being missed, delayed, or misunderstood. There is an emotional weight to that responsibility because behind every record, dataset, or disclosure request is a person whose situation is rarely straightforward.

Much of the Caldicott Guardian role involves navigating tensions that will be familiar to anyone working in safeguarding, applying the Caldicott Principles at the heart of decisions and ensuring decisions made are noted. Share too little, and critical risk may remain hidden. Share too much, and trust may be undermined for all involved. No formula removes this tension entirely, no checklist guarantees certainty but data matching between agencies can help. When insights are surfaced, more informed decisions can then be guided by principles, professional experience, and context.

A common misconception is that information governance exists primarily to restrict or prevent, that its function is to say “no.” In my experience, the intent is quite different. Good governance is designed to enable confident, defensible decision making. It provides clarity where fear or uncertainty might otherwise dominate. In safeguarding work, governance is not separate from protection; it is part of the infrastructure that allows necessary information to flow responsibly on a day to day basis.

My own path into the Caldicott Guardian role was shaped by years of working in environments where decisions had to be made in conditions of uncertainty. From starting in benefit investigations, to later being the records manager of a local authority, with responsibility for historic children social services records in paper form going back decades. Safeguarding rarely offers perfect visibility. Professionals must assess sometimes constantly evolving situations, incomplete information, and competing priorities, often in real time. That’s a tough ask that demands compliance, solid judgement and being brave.

Becoming a Caldicott Guardian felt less like a departure from frontline practice and more like an extension of it. I see it as an opportunity to help organisations move away from decision making shaped by incomplete information and towards principled, proportionate, and ethically grounded approaches to information sharing.

Much of the work involves supporting colleagues as they think through questions that are rarely black and white. Is sharing necessary and proportionate? What risk is managed by sharing, and what risk is managed by not sharing? How do we protect confidentiality while still enabling effective safeguarding decisions? These are inherently contextual judgements, not mechanical ones. Always feeding in learning and linking in the caldicott principles.

At its heart, the Caldicott Guardian function is grounded in trust. Trust from service users that their information will be handled with care and respect. Trust from professionals that governance will support rather than obstruct. Trust from organisations that decisions are guided by principles rather than fear or convenience. Safeguarding systems depend on that trust, because effective protection relies on the ability to share insight responsibly.

Safeguarding has never been a compliance exercise. It is a practice built on judgement, accountability, and professional responsibility with people in vulnerable situations at its core. Information governance, when understood properly, strengthens those foundations rather than constraining them. It helps organisations to ask “Can we share this?” and, going further, “What is the right thing to do, and how do we do it responsibly?”. Each time making distinctions around the Caldicott Principles, such as Principle 1 (justify the purpose) or Principle 7 (duty to share).

Some key takeaways and top tips so far from this new role are:

• Make sure you fully document any decision you make about sharing information with your rationale,
• There is a great network of support out there, draw upon their knowledge and shared experiences – you are not alone,
• If you don’t know your internal support network, find them now before you actually need them. The landscape is getting more complex with huge increases in need.
• A common sense approach is still a factor, and even encouraged.

I’m always interested in how others experience this balance in practice. How do you navigate the tension between protecting confidentiality and enabling safeguarding decisions in your setting?