Data security roles
Published on: 19th January 2021 | Updated on: 2nd April 2026
Every pharmacy must have clear responsibilities for data security and information governance (IG). In smaller pharmacies, one person may cover several of these roles.
The Data Security and Protection Toolkit (Toolkit) includes questions about these roles and responsibilities. Assigning roles in the Toolkit also updates your organisation profile.
The person responsible for leading on data security and managing information risk within the organisation.
The superintendent pharmacist oversees the professional and clinical management of the pharmacy, including the safe sale and supply of medicines.
The National Data Guardian recommends that health and social care organisations appoint a Caldicott Guardian to protect patient confidentiality and ensure appropriate use of health data.
Pharmacy owners are not required to appoint a registered Caldicott Guardian, but may choose to do so. Someone senior—such as the IG lead—should already take responsibility for confidentiality and appropriate data use.
Helpful resources:
A Caldicott Guardian can also be appointed across multiple pharmacies.
The DPO role is defined under GDPR. The DPO advises on compliance and should have expert knowledge of data protection law.
Pharmacies must have a DPO. Guidance at the ICO website.
Pharmacy owners can download and adapt: Data security (DS) and IG template 21: Data security roles (see DS templates webpage).
For more information on this topic please email comms.team@cpe.org.uk
