Skip to content Skip to nav
Accessibility statement
Important changes to Information Sharing Duty:

Effective from September 2026, the Information Duty will commence under the Children's Wellbeing and Schools Act 2026 and will supersede the previous Department for Education guidance on information sharing.

Find out what this means to you here

Information sharing and consent

On this page:

    The Data Protection Act 2018

    Practitioners must have due regard to the relevant data protection principles which allow them to share personal information. The Data Protection Act 2018 is the UK's implementation of the General Data Protection Regulation (GDPR). Everyone responsible for using personal data has to follow strict rules called 'data protection principles'. They must make sure the information is used:

    • fairly
    • lawfully
    • transparently.

    The Data Protection Act 2018 places greater significance on the need for organisations to be transparent and accountable in relation to their use of data. All organisations handling personal data must ensure they have comprehensive and proportionate arrangements for collecting, storing, and sharing information in place. This also includes arrangements on informing service users about the information they will collect and how this may be shared.

    The Data Protection Act 2018 does not prevent, or limit, the sharing of information for the purposes of keeping children and young people safe.

    Practitioners looking to share information without consent should consider which processing condition in the Data Protection Act 2018 is most appropriate in the particular circumstances of the case. This may be the safeguarding processing condition or another relevant provision.

    National guidance on sharing information

    There will be occasions when it would not be appropriate to tell parents, or carers, that the services are being contacted about a safeguarding concern. An example would be when telling parents or carers would put the child or young person at immediate or greater risk of harm. Such an approach is supported by legislation (Children Act 1989, 2004) and the professional guidance from individual agencies. Working Together to safeguard children (2023) contains 'myth busting information', detailed below.

    Information sharing key points and principles

    • Explain at the outset, openly and honestly, what and how information will be shared
    • always consider the safety and welfare of a child or young person when making decisions on whether to share information about them
    • seek consent to share confidential information. You may still share information if, in your judgement, there is sufficient need to override the lack of consent
    • seek advice where you are in doubt
    • ensure the information is accurate and up to date, necessary, shared only with those people who need to see it, and shared securely
    • always record the reasons for your decision – whether it is to share information or not.

    Key principles for information sharing on GOV.UK (external website)

    Principles and disclosure schemes

    Concerns about adults who are in contact with children

    Practitioners should also be alert to sharing important information about any adults with whom that child has contact, which may impact on the child's safety or welfare.

    Those providing services to adults and children, for example GPs, may be concerned about the need to balance their duties to protect children from harm and their general duty of care towards their patient or service user, for example a parent.

    Some practitioners and staff face the added dimension of being involved in caring for, or supporting, more than one family member, such as the abused child, siblings, and the alleged abuser. However, the Children Act 1989 makes clear where there are concerns that a child is, or may be, at risk of significant harm, the overriding consideration is to safeguard the child (The Children Act 1989).

    Section 115 of the Crime and Disorder Act 1998

    Section 115 of the Crime and Disorder Act 1998 establishes the power to disclose information is central to the Act's partnership approach. The police have an important general power under common law to disclose information for the prevention, detection and reduction of crime. However, some other public bodies that collect information may not previously have had power to disclose it to the police and others.

    This section puts beyond doubt the power of any organisation to disclose information to police authorities, local authorities, probation service, health authorities, or to persons acting on their behalf, so long as such disclosure is necessary or expedient for the purposes of crime prevention. These bodies also have the power to use this information.

    Part 3 of the Data Protection Act 2018 covers the processing of personal data for 'law enforcement purposes'. It covers processing for the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

    Information Duty

    From September 2026, a new Information Sharing Duty will come into force as part of the Children's Wellbeing and Schools Act 2026.

    This will replace the current Department for Education guidance on sharing information.

    The new law says that if a professional has information about a child, they must share it with another appropriate professional if it could help them do their job.

    This could include:

    • understanding if a child is at risk
    • making important decisions
    • providing support
    • keeping a child safe.

    Information should only be shared if it is in the child's best interests. It does not need to be shared if doing so could cause more harm than good.

    You can find more information from central government:

    GOV.UK - Information sharing duty statutory guidance (external website)

    ERSCP will provide further updates and guidance when the official government guidance is published in September 2026.

    Effective sharing

    To effectively share information:

    • All practitioners should be confident of the processing conditions which allow them to store, and share, the information that they need to carry out their safeguarding role. Information which is relevant to safeguarding will often be data which is considered 'special category personal data' meaning it is sensitive and personal.
    • Where practitioners need to share special category personal data, they should be aware that the Data Protection Act 2018 includes 'safeguarding of children and individuals at risk' as one of conditions that allows practitioners to share information with others without consent.
    • Information can be shared legally without consent, if a practitioner is unable to, or cannot be reasonably expected to gain consent from the individual, or if to gain consent could place a child at risk.
    • Relevant personal information can also be shared lawfully if it is to keep a child or individual at risk safe from neglect or physical, emotional or mental harm, or if it is protecting their physical, mental, or emotional well-being.

    Working Together to safeguard children (2023)

    Working Together to safeguard children (2023) states that:

    "…all organisations and agencies should have arrangements in place that set out clearly the processes and the principles for sharing information. The arrangement should cover how information will be shared within their own organisation/agency, and with others who may be involved in a child's life.

    "... No single practitioner can have a full picture of a child’s needs and circumstances so effective sharing of information between practitioners, local organisations and agencies is essential for early identification of need, assessment, and service provision to keep children safe. Rapid reviews and child safeguarding practice reviews have highlighted that missed opportunities to record, understand the significance of, and share information in a timely manner can have severe consequences for children.

    "... Practitioners should be proactive in sharing information as early as possible to help identify, assess, and respond to risks or concerns about the safety and welfare of children. This may be when problems are first emerging (for example, persistent school absences) or where a child is already known to local authority children’s social care. Sharing information about any adults with whom that child has contact, which may impact the child’s safety or welfare, is also critical.

    "...all practitioners should not assume that someone else will pass on information that they think may be critical to keeping a child safe. If a practitioner has concerns about a child's welfare and considers that they may be a child in need or that the child has suffered or is likely to suffer significant harm, then they should share the information with local authority children's social care and/or the police. All practitioners should be particularly alert to the importance of sharing information when a child moves from one local authority into another, due to the risk that knowledge pertinent to keeping a child safe could be lost.

    "...all practitioners should aim to gain consent to share information, but should be mindful of situations where to do so would place a child at increased risk of harm. Information may be shared without consent if a practitioner has reason to believe that there is good reason to do so, and that the sharing of information will enhance the safeguarding of a child in a timely manner. When decisions are made to share or withhold information, practitioners should record who has been given the information and why."

    Consent therefore means the family are fully informed about their information being shared and the services they are being referred to, agree with the referral being made and understand what information will be exchanged and why. It is important to be honest from the outset and to respect the right to privacy of individuals.

    Conversations about a worry should usually begin with the family. It is a good way of exploring whether they share the concerns and worries and to assess help that might be needed. If parents or young people understand that you are trying to help and are willing to work with you, they may be open to you making a referral to obtain the help they require, which will need their explicit consent.

    Close all Open all

    Data protection legislation is a barrier to sharing information

    The Data Protection Act 2018 and UK GDPR do not prohibit the collection and sharing of personal information, but rather provide a framework to ensure that personal information is shared appropriately. In particular, the Data Protection Act 2018 balances the rights of the information subject (the individual whom the information is about) and the possible need to share information about them.

    Consent is needed to share personal information

    You do not need consent to share personal information. It is one way to comply with the data protection legislation but not the only way. UK GDPR provides a number of bases for sharing personal information. It is not necessary to seek consent to share information for the purposes of safeguarding and promoting the welfare of a child provided that there is a lawful basis to process any personal information required. The legal bases that may be appropriate for sharing data in these circumstances could be ‘legal obligation’, or ‘public task’ which includes the performance of a task in the public interest or the exercise of official authority. Each of the lawful bases under UK GDPR has different requirements. It is good practice to be transparent and inform parents/carers that you are sharing information for these purposes and seek to work cooperatively with them, where it is safe to do so.

    Personal information collected by one organisation/agency cannot be disclosed to another

    This is not the case unless the information is to be used for a purpose incompatible with the purpose for which it was originally collected. In the case of children in need, or children at risk of significant harm, it is difficult to foresee circumstances where information law would be a barrier to sharing personal information with other practitioners.

    Close all Open all

    Caldicott Guardian Principles

    A Caldicott Guardian is a senior person responsible for protecting the confidentiality of patient and service-user information and enabling appropriate information-sharing.

    The seven Caldicott Principles:

    • Justify the purpose(s) for using confidential information.
    • Don't use personal confidential data unless it is absolutely necessary.
    • Use the minimum necessary personal confidential data.
    • Access to personal confidential data should be on a strict need-to-know basis.
    • Everyone with access to personal confidential data should be aware of their responsibilities.
    • Comply with the law.
    • The duty to share information can be as important as the duty to protect patient confidentiality.

    The guardian plays a key role in ensuring that the NHS, the local authority’s social services departments, and partner organisations, satisfy the highest practicable standards for handling patient or client identifiable information.

    The Domestic Violence Disclosure Scheme (DVDS)

    The Domestic Violence Disclosure Scheme (DVDS) gives members of the public a formal mechanism to make enquiries about an individual who they are in a relationship with, or have concerns that someone they know may be violent towards their partner. This scheme adds a further dimension to the information sharing about children where there are concerns that domestic violence and abuse is impacting on the care and welfare of children within the family.

    Members of the public can make an application for a disclosure, known as the 'right to ask'. Anybody can make an enquiry, but information will only be given to someone at risk or a person in a position to safeguard the victim. The scheme is for anyone in an intimate relationship regardless of gender.

    Partner agencies can also request that a disclosure is made of an offender's past history where it is believed someone is at risk of harm. This is known as 'right to know'.

    If a potentially violent individual is identified as having convictions for violent offences, or information is held about their behaviour which reasonably leads the police and other agencies to believe they pose a risk of harm to their partner, a disclosure will be made.

    Article 8 in the European Convention on Human Rights states that: "Everyone has the right to respect for their private and family life, home and correspondence. There shall be no interference by a public authority with the exercise of this right except such as in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of rights and freedoms of others."

    Child Sex Offender Review (CSOR) Disclosure Scheme

    The Child Sex Offender Review (CSOR) Disclosure Scheme is designed to provide members of the public with a formal mechanism to ask for disclosure about people they are concerned about, who have unsupervised access to children and may therefore pose a risk. This scheme builds on existing, well established third-party disclosures that operate under the Multi-Agency Public Protection Arrangements (MAPPA).

    The police will reveal details confidentially to the person most able to protect the child (usually parents, carers or guardians) if they think it is in the child's interests.

    The scheme is managed by the police and information can only be accessed through direct application to them.

    If a disclosure is made, the information must be kept confidential and only used to keep the child in question safe. Legal action may be taken if confidentiality is breached. A disclosure is delivered in person (as opposed to in writing) with the following warning: “That the information must only be used for the purpose for which it has been shared i.e. in order to safeguard children.”

    The person to whom the disclosure is made will be asked to sign an undertaking that they agree that the information is confidential and they will not disclose this information further.

    “A warning should be given that legal proceedings could result if this confidentiality is breached. This should be explained to the person and they must sign the undertaking.” - Child sex offender disclosure scheme guidance on GOV.UK

    If the person is unwilling to sign the undertaking, the police must consider whether the disclosure should still take place.

    The seven golden rules for information sharing:

    1. Remember that the Data Protection Act is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately.
    2. Be open and honest with the person (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so.
    3. Seek advice if you are in any doubt, without disclosing the identity of the person where possible.
    4. Share with consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base your judgement on the facts of the case.
    5. Consider safety and well-being: Base your information sharing decisions on considerations of the safety and well-being of the person and others who may be affected by their actions.
    6. Necessary, proportionate, relevant, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up-to-date, is shared in a timely fashion, and is shared securely.
    7. Keep a record of your decision and the reasons for it – whether it is to share information or not. If you decide to share, then record.
    Loading asset information...