Personal data, special category data, and care records

Personal data is information about an identified or identifiable living person. In care settings this includes names, addresses, dates of birth, phone numbers, room numbers when linked to a person, photographs, voice recordings, contact details, care notes, and staff records.

Special category data is more sensitive and requires additional protection. In care homes this commonly covers health and disability information, mental health, ethnicity, religion or belief, sex life or sexual orientation, biometric identifiers used for ID, and other deeply personal details. Care records frequently include several types of special category data within the same entry.

What counts in everyday care?

• Care plans and daily notes: mobility, nutrition, continence, cognition, distress, pressure care, risks, preferences, and personal routines.
• Medicines information: MAR charts, allergies, diagnoses inferred from medicines, refusal records, and side effects.
• Communication and behaviour records: triggers, distress, mental health, dementia care needs, safeguarding observations, and family dynamics.
• Identity and contact information: next of kin, attorneys, deputies, GP details, hospital numbers, and emergency contacts.
• Staff information: rotas, sickness, disciplinary matters, training records, supervision notes, and personal contact details.

Lawful handling in simple terms

Care staff do not usually decide the organisation's lawful basis under UK GDPR - that is a management responsibility. Staff control day-to-day handling: what they open, what they write, what they say, what they send, and what they leave visible.

• Use information for a real care or work purpose: never out of curiosity or because you know the resident outside work.
• Use only what is necessary: do not collect, repeat, photograph, print, or share more than the task requires.
• Keep it accurate: record what happened, when, who was involved, what action was taken, and who was informed.
• Keep it respectful: write as if the resident or their representative may one day read the record, because they may.

Legal bases and staff-level training

Personal data is not limited to formal care notes. Names, room-linked information, photos, medicines details, staff records, and casual observations can all identify someone and must be handled for a real work purpose.