Health and Social Care (National Data Guardian) Act 2018
2018 c. 31
An Act to establish, and make provision about, the National Data Guardian for Health and Social Care; and for connected purposes.
[20th December 2018]

Be it enacted by the Queen's most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

1 National Data Guardian for Health and Social Care
(1) The Secretary of State must appoint an individual to hold office as the National Data Guardian for Health and Social Care (in this Act, “the Data Guardian”).
(2) The Data Guardian may publish guidance about the processing of health and adult social care data in England.
(3) The following must have regard to such guidance—
(a) a public body exercising functions that relate to the health service, adult social care or adult carer support in England;
(b) a person (other than a public body) providing—
(i) services as part of the health service,
(ii) adult social care, or
(iii) adult carer support,
pursuant to arrangements with a public body falling within paragraph (a).
(4) The Data Guardian must keep under review any guidance that has been published and has effect.
(5) The Data Guardian may revise any guidance as the Data Guardian considers appropriate, but if any guidance is revised, the guidance must be published as revised.
(6) Before publishing any guidance, the Data Guardian must consult such persons as the Data Guardian considers appropriate.
(7) The Data Guardian may give advice and information about, and assistance in relation to, the processing of health and adult social care data in England.
(8) The power to publish guidance or to give advice, information and assistance may (as well as being exercised in relation to all cases to which it extends) be exercised in relation to—
(a) those cases subject to specified exceptions, or
(b) particular cases or classes of case.
(9) Nothing in subsection (3) requires a public body or person to have regard to guidance that is not relevant to the functions of the body or the activities of the person that are mentioned in that subsection.
(10) Schedule 1 makes further provision about the Data Guardian.
S. 1 in force at 1.4.2019 by S.I. 2019/580, reg. 2

2 Interpretation
(1) This section applies for the purposes of section 1 and this section.
(2) “Adult carer support” means support provided to a carer under Part 1 of the Care Act 2014.
(3) “Adult social care”—
(a) includes all forms of personal care and other practical assistance provided for individuals aged 18 or over who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or other assistance;
(b) does not include anything provided—
(i) by virtue of any of sections 23C to 24D of the Children Act 1989;
(ii) by an establishment or agency for which Her Majesty's Chief Inspector of Education, Children's Services and Skills is the registration authority under section 5 of the Care Standards Act 2000;
(iii) by virtue of section 3 of the Adoption and Children Act 2002.
(4) “Carer” has the meaning given in section 10 of the Care Act 2014.
(5) “The health service” means the health service continued under section 1(1) of the National Health Service Act 2006.
(6) “Health and adult social care data” means information (however recorded) that—
(a) relates to—
(i) the physical or mental health or condition of an individual, the diagnosis of his or her condition or his or her care or treatment;
(ii) adult social care provided to an individual (or an assessment for such care);
(iii) adult carer support provided to an individual (or an assessment for such support),
whether or not the identity of the individual is ascertainable, or
(b) is to any extent derived, directly or indirectly, from such information.
(7) “Processing” has the meaning given in section 1(1) of the Data Protection Act 1998.
(8) “Public body” means a body or other person whose functions—
(a) are of a public nature, or
(b) include functions of that nature,
but in the case of paragraph (b), the body or person is a public body to the extent only of those functions.
S. 2 in force at 1.4.2019 by S.I. 2019/580, reg. 2

3 Consequential amendments
Schedule 2 contains amendments that are consequential on this Act.
S. 3 in force at 1.4.2019 by S.I. 2019/580, reg. 2

4 Extent
This Act extends to England and Wales only.
S. 4 in force at 1.4.2019 by S.I. 2019/580, reg. 2

5 Commencement
(1) This Act comes into force on such day as the Secretary of State may by regulations appoint.
(2) Regulations made under this section are to be made by statutory instrument.
S. 5 in force at 1.4.2019 by S.I. 2019/580, reg. 2

6 Short title
This Act may be cited as the Health and Social Care (National Data Guardian) Act 2018.
S. 6 in force at 1.4.2019 by S.I. 2019/580, reg. 2

SCHEDULES

SCHEDULE 1 FURTHER PROVISION ABOUT THE DATA GUARDIAN
Section 1

Appointment
1 Subject to paragraphs 2 to 6, a person holds and vacates the office of Data Guardian in accordance with the terms of his or her appointment.
Sch. 1 para. 1 in force at 1.4.2019 by S.I. 2019/580, reg. 2
2 The period for which a person is appointed as the Data Guardian must not exceed three years.
Sch. 1 para. 2 in force at 1.4.2019 by S.I. 2019/580, reg. 2
3 A person who has held office as the Data Guardian may be re-appointed once only.
Sch. 1 para. 3 in force at 1.4.2019 by S.I. 2019/580, reg. 2
4 The Data Guardian may at any time resign the office by giving notice in writing to the Secretary of State.
Sch. 1 para. 4 in force at 1.4.2019 by S.I. 2019/580, reg. 2
5 The Secretary of State may remove the Data Guardian from office if satisfied that he or she is unable, unwilling or unfit to perform the functions of the Data Guardian.
Sch. 1 para. 5 in force at 1.4.2019 by S.I. 2019/580, reg. 2
6 Service as the Data Guardian is not service in the civil service of the State.
Sch. 1 para. 6 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Remuneration, expenses and allowances, etc.
7 The Secretary of State may pay to or in respect of the Data Guardian such remuneration, expenses, pensions, allowances or compensation for loss of office as the Secretary of State may determine.
Sch. 1 para. 7 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Staff and advisors
8 The Data Guardian may appoint staff and advisors as the Data Guardian may determine.
Sch. 1 para. 8 in force at 1.4.2019 by S.I. 2019/580, reg. 2
9 The Data Guardian may pay—
(a) any remuneration, expenses, allowances and sums by way or in respect of pensions to or in respect of staff;
(b) any expenses and allowances to advisors.
Sch. 1 para. 9 in force at 1.4.2019 by S.I. 2019/580, reg. 2
10 Service as a member of staff of or advisor to the Data Guardian is not service in the civil service of the State.
Sch. 1 para. 10 in force at 1.4.2019 by S.I. 2019/580, reg. 2
11 The Data Guardian may authorise a member of his or her staff to do anything required or authorised to be done by the Data Guardian.
Sch. 1 para. 11 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Secondments
12 The Data Guardian may make arrangements for persons to be seconded to serve as members of his or her staff.
Sch. 1 para. 12 in force at 1.4.2019 by S.I. 2019/580, reg. 2
13 The arrangements may include provision for payments by the Data Guardian to the person with whom the arrangements are made or directly to seconded staff (or both).
Sch. 1 para. 13 in force at 1.4.2019 by S.I. 2019/580, reg. 2
14 A period of secondment does not affect the continuity of a person's employment with the employer from whose service he or she is seconded and, in particular, does not affect such a person's continuity of service in the civil service of the State.
Sch. 1 para. 14 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Financing
15 The Secretary of State must pay to the Data Guardian such sums as the Secretary of State considers appropriate for the purpose of enabling the Data Guardian to perform his or her functions.
Sch. 1 para. 15 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Report and accounts
16 The Data Guardian must keep proper accounts and proper records in relation to accounts.
Sch. 1 para. 16 in force at 1.4.2019 by S.I. 2019/580, reg. 2
17 As soon as reasonably practical after the end of each financial year, the Data Guardian must produce an annual report which includes—
(a) a statement of accounts for that financial year in such form as the Secretary of State may direct;
(b) a general description of any guidance published and advice, assistance and information given by the Data Guardian in that financial year;
(c) a general description of the Data Guardian's priorities for the current financial year.
Sch. 1 para. 17 in force at 1.4.2019 by S.I. 2019/580, reg. 2
18 The Data Guardian must send a copy of the annual report to the Secretary of State before the end of June next following the financial year to which the statement of accounts relates.
Sch. 1 para. 18 in force at 1.4.2019 by S.I. 2019/580, reg. 2
19 The Secretary of State must lay a copy of the annual report before Parliament.
Sch. 1 para. 19 in force at 1.4.2019 by S.I. 2019/580, reg. 2
20 “Financial year” means—
(a) the period beginning with the day on which the first person is appointed under section 1 and ending with the following 31 March, and
(b) each successive period of 12 months.
Sch. 1 para. 20 in force at 1.4.2019 by S.I. 2019/580, reg. 2

SCHEDULE 2 CONSEQUENTIAL AMENDMENTS
Section 3

Public Records Act 1958 (c. 51)
1 In Part 2 of the table in paragraph 3 of Schedule 1 to the Public Records Act 1958 (definition of public records) insert at the appropriate place— “ The National Data Guardian for Health and Social Care. ”
Sch. 2 para. 1 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Parliamentary Commissioner Act 1967 (c. 13)
2 In Schedule 2 to the Parliamentary Commissioner Act 1967 (departments etc subject to investigation) insert at the appropriate place— “ The National Data Guardian for Health and Social Care. ”
Sch. 2 para. 2 in force at 1.4.2019 by S.I. 2019/580, reg. 2

House of Commons Disqualification Act 1975 (c. 24)
3 In Part 3 of Schedule 1 to the House of Commons Disqualification Act 1975 (other disqualifying offices) insert at the appropriate place— “ National Data Guardian for Health and Social Care. ”
Sch. 2 para. 3 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Freedom of Information Act 2000 (c. 36)
4 In Part 6 of Schedule 1 to the Freedom of Information Act 2000 (public authorities to which that Act applies) insert at the appropriate place— “ The National Data Guardian for Health and Social Care. ”
Sch. 2 para. 4 in force at 1.4.2019 by S.I. 2019/580, reg. 2

Equality Act 2010 (c. 15)
5 In Part 1 of Schedule 19 to the Equality Act 2010 (public authorities to which the public sector equality duty applies), under the heading “Health, social care and social security”, after the entry relating to the Health and Social Care Information Centre insert— “ The National Data Guardian for Health and Social Care. ”
Sch. 2 para. 5 in force at 1.4.2019 by S.I. 2019/580, reg. 2