ICO updates: implications for social care

July 7th 2026

The Information Commissioner’s Office (ICO) has published a series of recent updates that are well worth a look if you work in adult social care.

They cover new requirements under the Data Use and Access Act, the ICO’s Better Records Together campaign, and the importance of handling people’s records in a way that builds trust.

Data Use and Access Act: data protection complaints processes

The full Data Use and Access Act is now in force, with changes introduced gradually over the past 12 months. One of the most recent changes is a new requirement for organisations to have a clear process for managing complaints about how people’s data is protected.

That matters in social care, where organisations hold some of the most personal and sensitive information about people’s lives, health, relationships and support needs.

A data protection complaint might be about how an organisation has responded to a subject access request, how securely information has been stored, or how personal information has been collected, used, kept or corrected. The ICO is clear that people do not need to use legal language or quote legislation to raise a concern.

Under the new law, organisations must give people a way to raise a data protection complaint, acknowledge it within 30 days, investigate it properly and tell the person the outcome without undue delay. For details, see ICO’s guidance.

Trust and appropriate access to records

The ICO has also issued strong messaging for health and care providers on appropriate access to records.

In its blog Curiosity is not an excuse, the ICO says:

“When people seek medical care, they share some of the most sensitive personal information about themselves. They do so out of necessity, and in trust that it will be in safe hands.”

It also warns that “having the ability to view a record is not the same as having a legitimate need to do so”. In other words, just because someone can access a record does not mean they should.

For care services, this is a useful reminder. Protecting information is not only about having the right systems in place. It is also about culture: clear expectations, regular reminders, good training, visible leadership and checking that records are only accessed for the right reasons.

Better Records Together

The ICO is also running their Better Records Together campaign, which is calling on local authorities and health and social care trusts to make a commitment to create better records, together. The campaign asks organisations that create, hold or provide access to care records to improve how those records are created, handled, stored and shared with people who have care experience.

In particular, the ICO is calling on senior leaders to take visible responsibility for improving care records across their organisations.

It sets out five things leaders should do:

Champion care records: make it clear that high standards in handling care records matter to the organisation and the people it supports.
Implement the ICO’s care records standards: explain why the standards matter, why they are a priority and why they are everyone’s responsibility.
Resource your teams: recognise that this is more than a legal duty or technical task for a data protection officer. Teams need time, capacity and support.
Support your staff: take a joined-up approach across the organisation and provide the training people need to handle care records confidently and consistently.
Invest to transform: build better records now, using the ICO’s standards to reduce future challenges and improve the systems that support good practice.

In practice, this means leaders setting the tone, asking the right questions and making sure record-keeping is treated as part of good care, not just a back-office process.

Michelle Corrigan, Chief Executive Officer at Digital Care Hub, said:

“These ICO updates are a helpful reminder that good data protection is part of good care. At Digital Care Hub, this very much reflects our own approach: supporting care providers to use data and digital systems safely, confidently and in ways that build trust.

“Good record-keeping is not just a compliance issue. It is about dignity, transparency and making sure people can trust the organisations that support them.”

Co-production in Digital Care: Putting People in Control

AI in Care: Its Use and Regulation – in Conversation with CQC