Your sector adds its own rules to UK data protection law

The ICO's guidance says it is an advantage if your data protection officer also knows your industry or sector well. It is a fair question for any outside adviser too: what has the team done in your sector before? The guide to choosing a data protection adviser has more questions.

Health and care: NHS patient data and UK GDPR

UK GDPR gives health data extra protection, and your sector adds more. NHS England says every organisation with access to NHS patient data and systems must use its Data Security and Protection Toolkit.

Can we use AI on patient data?

You can use AI on patient data, within limits. Under UK GDPR, a machine alone can make a significant decision using health data on two grounds only. One is the person's explicit consent. The other is where a contract needs it or the law allows it, and there is a substantial public interest. Large-scale use of health data also needs a data protection impact assessment.

What rules apply to health data in the US?

In the US, HIPAA applies to many organisations. The HIPAA Privacy Rule is a US federal rule. It applies to health plans, healthcare clearinghouses and every healthcare provider that sends health information electronically in certain transactions.

Financial services: reporting incidents to the UK's FCA

From 18 March 2027, a firm regulated by the UK's Financial Conduct Authority (FCA) may have two regulators to tell after an incident.

Who do we tell if there is a data breach?

You may have to tell two regulators. Under UK GDPR, you must report a breach likely to put people at risk to the UK data protection regulator. Do it without undue delay and, where feasible, within 72 hours. From 18 March 2027, most firms regulated by the UK’s FCA must also report operational incidents, such as cyber attacks, that meet set thresholds.

Law firms in England and Wales: client confidentiality

Solicitors in England and Wales must keep client affairs confidential under the SRA code.

Schools in England: academies and maintained schools need a DPO

In England, maintained schools and academies must have a data protection officer.

Sector rules on data: what to check first

1. Find the rules your sector adds on data, and who enforces them.
2. Check whether you hold special category data, such as health data, which UK law protects more closely.
3. Plan who you tell after a breach: the UK data protection regulator, and your sector regulator where its rules require it.
4. Check the UK rules on automated decisions before an AI tool makes decisions about people with no human involved.
5. If you bring in outside help, ask for an example of past work in your sector, such as a risk assessment on patient data.

Data protection in regulated sectors: common questions

Do we need a data protection officer?

UK GDPR requires a data protection officer in three cases. You are a public authority. Your core work tracks people regularly, systematically and at scale. Or it uses health, criminal or other sensitive data at scale.