A new statutory safeguarding information sharing duty comes into force on 30 September 2026, and will apply to a wide range of education and childcare providers in England. We look at when information must be shared, what the changes mean for consent, data protection and safeguarding practice, and the practical steps providers should take now.

Jump to:

Summary

Who does the duty apply to?

When must information be shared?

What information must be shared?

What does this mean for data protection?

Practical next steps

Summary

  • A new information sharing duty (under section 16LA of the Children Act 2004) comes into effect on 30 September 2026, strengthening expectations relating to safeguarding practice. Introduced by the Children’s Wellbeing and Schools Act 2026, it requires relevant organisations to share information where it is relevant to safeguarding and promoting a child’s welfare, including where concerns relate to early help, prevention and unmet need, unless sharing it would be more detrimental to the child than not sharing.
  • Importantly, parental consent is not required to share information under the new statutory duty.
  • Organisations and practitioners do not need to wait until a child is at risk of significant harm, or until another formal safeguarding threshold has been met. Information relating to early help, prevention, emerging concerns and unmet need may need to be shared. Information that appears limited or inconclusive in isolation may become significant when combined with information held by other agencies.
  • A key purpose of the statutory duty is to remove uncertainty that has historically caused practitioners to withhold information, particularly uncertainty around consent, confidentiality, data protection and whether a child has crossed a formal safeguarding ‘harm’ threshold.
  • The Department for Education’s new statutory guidance, Information Sharing Duty: Statutory guidance for safeguarding organisations and their practitioners, should be read alongside, rather than as a replacement for, other relevant frameworks, including Keeping Children Safe in Education, Working Together to Safeguard Children, Working Together to Safeguard Children and the Information Commissioner’s Office’s Data Sharing Code of Practice.

Who does the duty apply to?

The duty applies to a specified range of safeguarding partners and relevant agencies in England, including:

  • schools, colleges and early years settings,
  • local authorities;
  • Integrated Care Boards and NHS Trusts;
  • police;
  • prisons and probation;
  • youth justice and youth custody services; and
  • providers carrying out relevant services under arrangements with those bodies, including GPs, dentists and other primary care providers.

Importantly, the duty governs sharing between organisations and practitioners within its scope. Sharing safeguarding information with an organisation outside the statutory duty may still be lawful, appropriate or required, but the legal basis for doing so needs to be considered separately.

When must information be shared?

The duty applies where an organisation:

  • holds information about a child, or about another individual connected to that child;
  • considers the information relevant to safeguarding or promoting the welfare of the child; and
  • considers that disclosure to another organisation within scope may facilitate the recipient in carrying out its relevant safeguarding functions.

The duty also applies where an organisation receives a request for relevant information from another organisation within scope.

The obligation applies to scenarios arising on or after 30 September 2026. Organisations do not need retrospectively to revisit every historic decision not to share, although they may choose to revisit information where an ongoing need or concern remains.

The statutory guidance distils the decision into three key questions:

  • 1. Is the information relevant?

Does the information have a bearing on safeguarding or promoting the child’s welfare? If responding to a request for information, has enough context been provided to assess its relevance?

  • 2. Could sharing “facilitate” the recipient’s functions?

Is the proposed recipient within scope of the duty, and could sharing reasonably help it assess need or risk, make a decision, provide support or take action to safeguard or promote the child’s welfare? This can include situations in which a child may pose a risk to another child.

  • 3. Would sharing be more detrimental to the child than not sharing?

The duty does not apply where, using professional judgement, the organisation considers that disclosure would cause greater detriment to the child than withholding the information. The guidance makes clear that this is intended to be an exceptional outcome and practitioners should consider whether any risk can instead be mitigated, for example by limiting the information disclosed.

Lack of consent, fear of a complaint, practitioner discomfort or general concerns about data protection are not, by themselves, reasons not to share where the statutory duty applies.

What information must be shared?

  • One of the most significant aspects of the new regime is its breadth.
  • Where the statutory information sharing threshold is met, you can share confidential information about the child, and any other individual connected with the child, where the information is relevant to the child’s welfare or safety.
  • Information about adults and other children is expressly covered by the statutory duty. This might include information about parents, carers, siblings, peers and other adults. For example, information concerning a carer’s health, substance misuse, imprisonment, abusive relationship might be relevant where it affects their ability to safely care for a child. The guidance cautions against making assumptions e.g. that a parent with physical or mental health issues in and of itself is evidence that a parent cannot safely care for a child. Professional judgement and context therefore remain key.
  • The duty can also apply where one child potentially poses a risk to another. Information should not be withheld simply because the child who is the subject of the information is not themselves considered to be at risk.
  • At the same time, the new duty is not an instruction to share entire files indiscriminately. If only particular information is relevant and proportionate, that is what should be provided. The statutory guidance expressly contemplates providing relevant extracts or a summary rather than a complete case file where the complete file is unnecessary.  

What does this mean for data protection?

Lawful Basis

  • Data protection must not be a barrier to sharing safeguarding information, and the statutory duty provides a clear lawful basis under the UK GDPR for organisations to share personal data in this context.
  • Although consent is a possible lawful basis and/or condition for processing personal data and special category data, organisations are not required to obtain consent before sharing safeguarding information under this duty. Indeed, consent is unlikely to be appropriate in a safeguarding context, given that organisations will need to share the relevant information by law (or at the very least to protect a child or vulnerable individual).
  • In particular, an organisation will be able to rely on the lawful basis that the sharing is necessary to enable it to comply with a legal obligation (per Article 6(1)(c) UK GDPR). The statutory guidance also makes clear that organisations may be able to rely on the ‘public task’ lawful basis (for public bodies) or the ‘recognised legitimate interests’ lawful basis, which has been recently introduced by the Data (Use and Access) Act 2025 (for volunteer/private organisations).
  • When processing special category data , organisations will likely be able to rely on the specific condition under Schedule 1 that applies to processing special category/criminal offence data for safeguarding purposes. Note that if an organisation intends to rely on this safeguarding condition, it must have in place an Appropriate Policy Document, which sets out the organisation’s compliance measures for special category data.

Other data protection principles

  • While the statutory duty and guidance provide comfort that safeguarding information can be shared lawfully, organisations must also carry out such sharing in accordance with the other data protection principles under Article 5 UK GDPR – the key principles here include:
    • Transparency – organisations should: (i) update their privacy notices to make clear that they may need to share personal data with other organisations in a safeguarding context; and (ii) consider what information it would be appropriate to provide to individuals prior to the sharing of their information (if any).
    • Data minimisation – as noted above, organisations must only share what is necessary in light of the statutory duty.
    • Accuracy – organisations must ensure that the personal data they hold and share is not incorrect or misleading as to any matter of fact, and take steps to correct or erase personal data that is incorrect or misleading. When sharing matters of opinion, organisations must make clear that a piece of information is an opinion, rather than a matter of fact;
    • Security – organisations must ensure that the personal data that they hold is kept sufficiently secure, including by limiting access to staff who need to see it as part of their roles (as well as considering more technical measures); and
    • Accountability – organisations should (but are not required to) put in place a data sharing agreement with partners with whom they might share safeguarding information. To be clear, a data sharing agreement is not required to share this information, and the absence of an agreement will not mean that an organisation can avoid compliance with the statutory duty. However, a data sharing agreement is recommended (and expected), per the Data Sharing Code of Practice prepared by the Information Commissioner’s Office (very soon to be the Information Commission). Organisations processing safeguarding information are also likely to be required to prepare a Data Protection Impact Assessment (“DPIA”) in relation to that processing.

There may be situations in which safeguarding information needs to be shared on an urgent basis, which means that organisations may not be able to comply with their usual processes. Ideally, organisations should plan for emergencies and urgent cases, but should in any event provide the information that is needed to safeguard individuals even if they need to do so in a way that circumvents their usual data protection processes.

Practical next steps

  • Update safeguarding policies and procedures to reflect the positive duty to share information where the section 16L criteria are met. Review, in particular, any wording suggesting that parental consent is required before safeguarding can be shared.
  • Train staff to ensure everyone is aware of the lower information sharing thresholds. Emphasise that they do not need to wait for a crisis or a high harm threshold to share information. Early intervention for unmet needs or emerging welfare concerns (whether in relation to one of their children or someone connected to them) is now the priority.
  • Ensure reporting procedures are clear and accessible for all staff. Build the three statutory considerations, relevance, facilitation and detriment, into safeguarding procedures, referral forms and training. Make clear where staff should obtain advice when they are unsure.
  • Review how you communicate with parents, carers and children. As a general rule, explain to them what information is being shared, with whom and why, unless doing so would expose the child or someone else to risk, or would otherwise be inappropriate. Avoid asking for consent where consent is not what determines whether the information will be shared.
  • Clearly document your rationale for your decisions to share or not share information, including your assessment of relevance, how disclosure could facilitate safeguarding functions, any potential detriment to the child and any mitigation considered.
  • Review arrangements when children move settings. Information must follow children when they relocate (eg early years to school, primary to secondary, school-to-school transfers, to another local authority area, and post-16 moves). The statutory guidance emphasises the importance of transferring relevant safeguarding information and sharing concerns across organisational and geographical boundaries within England.
  • Consider what information you need to share. It won’t necessarily be appropriate to send the whole safeguarding file on a child.
  • Update privacy notices and data protection documentation to make clear that you may be obliged under law to share safeguarding information in some cases, and to include reference to the lawful basis (or bases) and condition(s) that you rely on. The introduction of the statutory data is a good time to review your internal processes relating to data protection, including in particular the security measures that apply to safeguarding information, and policies relating to handling data subject rights requests (including requests to access, correct, or delete data).
  • Consider whether you need to prepare an Appropriate Policy Document to cover the processing/sharing of special category data or criminal offence data in reliance on the safeguarding condition under Schedule 1 of the Data Protection Act 2018.
  • Consider whether you need to enter into a data sharing agreement with partners, and/or whether any existing data sharing agreements should be amended to reflect the statutory duty and the sharing of safeguarding information in that context. Remember that data sharing agreements are not a requirement for sharing safeguarding information, but strongly recommended as a matter of general data protection compliance.
  • Consider whether you need to prepare and/or update any DPIAs in relation to the processing of safeguarding information.

If you or your organisation would like advice or support in relation to any of the issues discussed in this article, please contact Jean Tsang or Rayhaan Vankalwala.