The new Information Sharing Duty to safeguard children: when should we share our information?

Practitioners working with children have always been careful to keep safeguarding information confidential and not share it unless necessary. However, when should that information be actively shared, and how can this be justified in law? The new duty to share information introduced by the Children’s Wellbeing and Schools Act 2026 makes it clear that information should be shared when it is relevant to safeguard a child. However, the new statutory guidance issued to assist controllers is helpful in explaining how and why information should be shared, with direct reference to real-life scenarios.

The new duty

From 30 September 2026, some public sector organisations will be required, under the new section 16LA of the Children Act 2004, to share information with relevant public bodies if it holds information about a child, or another individual connected to that child, and considers that the information is relevant to safeguarding or promoting the child's welfare (or where the child may pose a risk to others). If sharing that information may assist another relevant organisation in assessing risk, making decisions, providing support or taking safeguarding action, the information must be shared (even where a specific statutory threshold under other child protection legislation, such as s.47 child protection enquiries, may not be met).

The duty is subject to a narrow exception where a practitioner determines, using professional judgement, that sharing the information would be more detrimental to the child than not sharing it. The guidance anticipates that such cases should be rare.

It is important to recognise that this duty only applies to a limited group of public authorities (see subsection 4 of the new S16LA). Many controllers who process sensitive personal information about children should still be aware of the duty, however, as it now forms the Government’s recommended best practice. In particular, some organisations such as Registered Providers of Social Housing may process a lot of relevant child personal data, and whilst not strictly subject to the duty, may wish to consider sharing that information when considering the welfare of their residents.

Practical clarifications of the law

Previously, many organisations had concerns about the lack of parental consent, fear of complaints, and concerns about compliance with data protection law and the common law duty of confidentiality, when deciding whether to share safeguarding or child welfare information. Helpfully, statutory guidance published alongside the new requirements targets these sources of uncertainty in Chapter 3. In particular, the guidance discusses the lawful bases for sharing such information under the UK GDPR. In particular, the new duty gives practitioners a clear legal obligation, under Article 6(1)(c) UK GDPR, to share such information. For many organisations, this will be helpful as it sets out a clear, justifiable reason why the sharing of safeguarding information is necessary. Note, though, that this does not mean that an organisation should not also rely on demonstrating another lawful basis for this processing. Many organisations bound by the duty will be performing safeguarding obligations as part of their public task (under Article 6(1)(e) UK GDPR), whilst many others will likely have a legitimate interest (or a recognised legitimate interest) as well.

The guidance also explains the role of ‘consent’, rather than ‘transparency’ in this context. Crucially, consent from the data subjects under data protection law is not necessary to share relevant safeguarding information with relevant third parties. Consent is just one of several lawful bases of processing, and is very rarely appropriate for any processing activities involving safeguarding information. Instead, by being transparent with the relevant individuals and explaining why information may have to be shared without their consent, controllers may be able to manage expectations of parents and continue to act in the best interests of the child involved, whilst also complying with safeguarding obligations. Whilst transparency starts with a well-written, targeted privacy notice, it can extend to direct engagements with stakeholders if necessary.

An important reminder to share necessary information, not documents

Whilst clarifying common mistakes made in data protection law, the guidance has been drafted in a practical manner, and invites the reader to think about what information should be shared and why. This is a welcome change which encourages organisations to take a proportionate response to sharing information.

To limit the purposes for processing personal data and minimise the data being processed, in line with the UK GDPR principles, the guidance recommends practitioners to think about the nature of any request they receive, and provide only the information which is necessary and proportionate. This includes, where necessary, only providing summaries or single pages of documents, rather than entire case files. It also covers both children with known needs and those whose needs are only beginning to emerge. To assist, we recommend that organisations consider the practical case studies, which use challenging but realistic situations to set out how a safeguarding information disclosure can be made safely and justified. This will be especially helpful when the information to be shared is not about a child, but about someone to whom that child is connected, often parents and other close family.

Key questions when complying with the duty

The new duty, and accompanying guidance, will make it easier for many organisations to understand when, how, and why safeguarding data should be shared legally. We recommend that all those working with children in any capacity should read the guidance in full. However, there are some key questions which DPOs should consider after reading the guidance:

1. Is my organisation required to comply with the duty? If it is not, how should we implement this as best practice guidance instead?
2. Which legal bases can we rely on for sharing relevant information for our organisation and the processing that we do?
3. Is my organisation now processing information because we are bound by the information sharing duty? (If yes, then your ROPA should be updated).
4. How should I train my staff to recognise when information should be shared, and when information should be requested to comply with safeguarding duties?
5. How should information be stored, and how should sharing be monitored, to ensure our organisation can justify every piece of information which is shared?

After asking these questions, many organisations may wish to review existing safeguarding policies, update staff guidance and training, and work with safeguarding partners in local areas to ensure information sharing processes align with the new statutory framework.

Anthony Collins regularly advises organisations on managing the sharing of safeguarding information. If you would like to discuss how your organisation should adapt to the new information sharing duty, please contact me.

Ben Pumphrey is a Legal Director at Anthony Collins.