ICO presses social care leaders on care records standards as enforcement action mounts

The Information Commissioner's Office has called on senior social care leaders across the UK to formally commit to implementing its care records standards warning that persistent failures in subject access requests are leaving vulnerable people systematically without their own records.

At a breakfast briefing attended this week by 55 senior social work professionals, to urge local authorities and health and social care trusts to urge support for its 'Better Records Together' campaign, Angela Balakrishnan, Executive Director of Strategic Communications and Public Affairs at the ICO, set out five areas of leadership action and made clear that enforcement will follow where organisations fail to make sufficient progress.

These are: championing care records as an organisational priority; implementing the ICO's published care records standards; adequately resourcing teams at every stage of the records lifecycle; providing staff with the training needed to handle records in line with ICO expectations; and investing in building records now that meet the standards, to reduce future backlogs.

The ICO's own research found that nearly nine in ten people (89%) who accessed their care records through a subject access request were left with questions or concerns. Over two thirds (71%) experienced poor communication from their local authority, and 69% said the process took longer than expected with some reporting waits of up to sixteen years.

Care records carry special category status under UK GDPR by virtue of the health and social care information they contain. Failures to handle them lawfully and responsibly engage obligations under Articles 5, 12, and 15 of UK GDPR, as well as the subject access provisions of the Data Protection Act 2018.

Balakrishnan described the initiative as collaborative rather than coercive, but was unambiguous about the consequences of not improving performance in this area. "It's not simply about mandating compliance but working together in the belief that we can all build a trusted system that truly serves the people whose lives these records reflect," she said. The pledge, she said, while voluntary, is a public signal to both citizens and people with care experience that an organisation is actively working to improve.

The ICO has been running a UK-wide supervision pilot across 2025 and 2026, monitoring the performance of 19 organisations to drive improvements. The pilot sits alongside a growing body of enforcement action that the regulator says it will escalate where delays are persistent and harm is not being adequately addressed.

Enforcement action already taken includes reprimands issued to Glasgow City Council and City of Edinburgh Council in February 2025, an enforcement notice to Bristol City Council in September 2025 for delays in child social care data, and an £18,000 fine to Scottish charity Birthlink in July 2025 for the destruction of approximately 4,800 personal records.

The ICO confirmed it will also assess how well organisations are following the Better Records Together care records standards when considering enforcement, meaning the standards, though not statutory in themselves, will be treated as a material benchmark in regulatory decision-making.

The campaign webpage and senior leader resources are available at ico.org.uk/about-the-ico/campaigns/better-records-together.