Do Care and Supported Living Providers Need a DPO?

It is one of the questions I am asked most often, and the honest answer is: it depends. Some care and supported living providers must appoint a Data Protection Officer, many do not, and a surprising number have not checked. Either way, "we do not need one" is not the same as "nobody is responsible". Here is how to work out where you stand, and what to do about it.

01 What the law actually says

Under UK GDPR, an organisation must appoint a DPO in three situations: if it is a public authority, if its core activities involve regular and systematic monitoring of people on a large scale, or if its core activities involve large-scale processing of special category data. Health information is special category data, and for a care provider, looking after people is the core activity.

The ICO describes core activities as your primary business activities: if you need to process personal data to achieve your key objectives, that is a core activity. Payroll and HR records, for example, are usually secondary. So the question for most care and supported living providers is not whether you handle health data as part of your core work. You do. The question is whether you handle it on a large scale.

02 What "large scale" means in practice

The law does not give a number. The ICO's guidance points to five factors: the number of people whose data you process, the volume of data, the range of different data items, the geographical extent of the activity, and how long the processing lasts. For examples, it refers to European guidance, which treats a hospital processing patient data as large scale and an individual doctor as not. That European guidance is no longer binding in the UK, but it remains a useful reference.

These are my own illustrations rather than ICO examples, but a provider supporting a handful of people in one house is likely to sit at the smaller end of that range. A provider with many services, hundreds of people supported and records across several systems sits closer to the other. Most real organisations fall somewhere in the middle, which is why a reasoned, written decision matters more than a yes or a no. The ICO itself says it is a good idea to record the decision if you conclude you do not need a DPO.

03 Not required does not mean not responsible

Whether or not you must appoint a DPO, the ICO is clear that you must still have enough staff and resources to meet your UK GDPR obligations. That means knowing what personal data you hold, protecting it, responding to requests and breaches on time, and being able to show your working. Someone has to own that.

Many providers also find that commissioners, insurers and CQC inspectors simply expect to see a named person for data protection. Being able to say who it is, and what they do, makes questionnaires and inspections much easier.

04 Be careful with the title "DPO"

If you appoint a DPO, even voluntarily, the ICO says the same requirements apply as if the appointment were mandatory. The DPO must report to the highest level of management, work independently, be properly resourced, and not be penalised for doing the job. They also must not hold another role that conflicts with it. In practice, that means someone who decides how and why personal data is used, such as a registered manager, operations lead or clinical lead, can be a poor fit. Their contact details must be published and given to the ICO, although you do not have to publish their name.

That is why some providers choose the title "data protection lead" for an internal role and keep "DPO" for a properly independent appointment. The ICO also says that specialists who support the DPO should not be called the DPO, because it is a specific role with legal requirements.

05 Getting the oversight without a full-time hire

Most small and growing providers cannot justify a full-time data protection salary, and do not need one. The ICO accepts that a DPO can be an existing employee, as long as there is no conflict of interest, or can be contracted out under a service agreement. An externally appointed DPO has the same position, tasks and duties as an internal one. Another option is a trained internal data protection lead, supported by outside expertise.

What matters is that the person has the expert knowledge, the time, and a direct route to the people who make decisions. The ICO also notes that knowledge of your sector is an advantage.

The question "do we need a DPO?" is really a question about oversight: who is looking after personal data, how do you know, and could you show it tomorrow? If you would like a plain-English view of what is right for your organisation, that is a conversation I am glad to have. This article is general information, not legal advice. The ICO has said that its DPO guidance is under review following the Data (Use and Access) Act 2025, so check the ICO's current guidance before making a decision.