AI and patient data in the UK: the NHS, the DSPT and Caldicott

A nurse asks a chatbot to rephrase a discharge letter. A junior doctor pastes lab results to get a summary. A practice administrator has a letter translated for a family. In British hospitals and GP surgeries these habits are becoming common, and they start with good intentions: saving time for patients.

The problem is that health data is among the most protected information in UK law. For the NHS and its suppliers, generative AI raises a very practical question: how do you use it without stepping outside the DSPT, the Caldicott principles and UK GDPR?

A framework that is already demanding

In the UK, health data is special category data under UK GDPR and the Data Protection Act 2018. Processing it requires a lawful basis plus an additional condition, and the Information Commissioner's Office (ICO) enforces the rules.

On top of that, the health sector has two reference points of its own:

• the Data Security and Protection Toolkit (DSPT), the annual self-assessment that every organisation with access to NHS patient data and systems must complete;

• the Caldicott principles, eight rules for handling confidential patient information, championed by the National Data Guardian.

Our first article on the UK covers the general framework: UK GDPR, the ICO and the EU AI Act. Here we focus on healthcare.

The DSPT, now aligned with the CAF

The DSPT is not a formality. For NHS trusts and several other bodies, it has been aligned since 2024-25 with the National Cyber Security Centre's Cyber Assessment Framework (CAF). The approach is built around expected outcomes rather than a simple checklist.

In practice, the organisation has to know where its data flows, who accesses it and how it detects an incident. Generative AI use with no visibility makes those answers hard. If nobody knows which patient information is going to external tools, it becomes difficult to claim the flows are under control.

The DSPT is submitted every year. An organisation that makes AI use visible now will be able to show, at its next submission, which risks it has identified and which measures are working.

What the Caldicott principles say

The Caldicott principles were written long before ChatGPT, but they fit AI very well. Three of them are especially useful:

1. Justify the purpose: every use of confidential information needs a clear objective.

2. Use confidential information only when necessary: if the task can be done without identifiable data, do without it.

3. Use the minimum necessary: only share what is essential.

To rephrase a letter, the AI does not need the patient's name, NHS number or date of birth. The Caldicott principles naturally point towards removing those details before anything is sent. That is exactly where daily practice slips: under pressure, people paste the whole document.

Approved uses and the rest

The NHS is not shutting the door on AI. In April 2025, NHS England published guidance on ambient scribing products, the assistants that draft notes from a consultation. It stresses risk assessment, data protection and the clinical responsibility of the organisation deploying them.

For approved tools, the path is well known: a data protection impact assessment (DPIA), supplier checks, a contract governing the processing, and information for patients. Large scale processing of health data is one of the cases where UK GDPR requires such an assessment.

The main risk lies elsewhere: consumer tools used outside any framework, on a shared workstation or a personal phone. This shadow AI has a real cost, which we break down in our article on the real cost of shadow AI.

Why training alone is not enough

Clinical teams already complete mandatory information governance training. They know the rules. But a rule learned once a year carries little weight at the end of a busy shift.

Mistakes rarely come from bad intent. They come from fatigue, urgency and tools that flag nothing. We explain why in our article on why AI security training does not work on its own. The answer is a safeguard at the moment of action.

How ZeusLock protects patient data

ZeusLock runs on staff devices and browsers. Before a prompt or file goes to an AI assistant, it spots sensitive data: names, NHS numbers, dates of birth, addresses, clinical details. Depending on the rule the organisation sets, it can:

• warn the user and remind them of the internal policy;

• block sending to an unapproved tool;

• replace identifiers with realistic values of the same format, so the AI stays useful without seeing the real patient.

That last option applies the minimum necessary principle directly. Our article on format preserving anonymization explains how it works. Every event is logged, giving the Caldicott Guardian and the data protection officer concrete evidence for the DSPT and for any questions from the ICO.

In short

For UK healthcare providers, generative AI is not forbidden, but it has to follow rules they already know: the DSPT, the Caldicott principles and UK GDPR. The key is to make those rules work at the moment a clinician types a request, by removing identifiers and keeping a record.

Want to see how ZeusLock protects patient data in your teams' AI tools? Book a demo.