Help

Finding a DPO

Every practice must have one. They can be shared or external.¹

Through your ICB

Ask whether it provides or arranges DPO support for practices.

Ask first: it may already exist

Shared across a PCN or federation

One DPO covers several practices.

Good for: spreading cost

An external provider

A company or commissioning support unit provides a DPO service for a yearly fee. Examples are listed in the references, as a guide only.^4,5

Good for: practices without in-house capacity

The usual route is through the ICB, though more practices now use external providers. The DPO advises independently, so they shouldn’t be someone who decides how data is used. That usually rules out the practice manager.¹

Caldicott Guardian and SIRO

Two senior roles, usually held by partners, with different jobs.⁶

Caldicott Guardian

Looks after confidentiality: is it right to use or share this patient’s information? Advises on sharing and is consulted on DPIAs.²

Senior Information Risk Owner

Owns information risk for the practice: security, breaches and compliance. Accepts the remaining risk in a DPIA.

In a small practice one partner may hold both, but they look at different questions, so two people is better where you can. The DPO is usually someone else, so their advice stays independent.¹

Training

All staff need data security awareness training, refreshed every year, and the DSPT asks you to show it.⁷ The free Data Security Awareness, Level 1 e-learning covers it,³ and most practice training platforms have an equivalent module. DPOs and IG leads need more; ask your ICB.

Common questions

Can staff use ChatGPT or a similar tool to write a letter?

Not with any patient details in a personal or free account. Only use AI tools the practice has approved, with a DPIA and agreement in place. Your practice AI policy should say which tools are approved: see AI policy. Tools provided through NHS contracts, such as Microsoft 365 Copilot, still need a DPIA that says whether patient information can be entered.

Do we need patient consent to use an AI scribe?

Not GDPR consent. Tell the patient, respect a no, and record their answer. See consent: two different things.

References

Appointing a data protection officer (DPO). BMA
NDG announces new Caldicott principle and guidance on Caldicott Guardians. National Data Guardian
Data Security Awareness, Level 1. e-Learning for Healthcare
Howbeck Healthcare. DPO service for GP practices. Listed as a guide only, not an endorsement
Primary care information governance and data protection services. Arden and GEM Commissioning Support Unit (NHS). Listed as a guide only, not an endorsement
Key relationships: Caldicott Guardian and SIRO. UK Caldicott Guardian Council
Data Security and Protection Toolkit. NHS England

Sources on this page last checked 3 November 2026.