In 2016, Dame Fiona Caldicott, published her report: 'Review of Data Security, Consent and Opt-outs' in which she proposed ten standards for health and social care. she also recommended the introduction of a national data opt-out which allows the public to opt-out of their confidential information being used for purposes other than their individual care and treatment; for example, for research and planning purposes.

1. Personal confidential data - All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes.
2. Staff responsibilities - All staff understand their responsibilities under the NDGs, including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.
3. Training - All staff complete appropriate annual data security training and must pass a mandatory test. This is why you are asked to complete this e-learning session annually.
4. Managing data access - Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals.
5. Process reviews - Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.
6. Responding to incidents - Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection.
7. Continuity planning - A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.
8. Unsupported systems - No unsupported operating systems, software or internet browsers are used within the IT estate.
9. IT Protection - A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.
10. Accountable suppliers - Suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s data security standard.