Information Sharing Tool: 7 Golden Rules

🔒 Rule 1 of 7, Purpose & Context

What information are you considering sharing, and why?

Be specific about what you want to share and with whom. A clear purpose is the foundation of a lawful information sharing decision.

Golden Rule 1, Working Together 2026

"Understand that the Data Protection Act 2018 and the Human Rights Act 1998 do not prevent the sharing of information for the purposes of keeping children safe."

Information you are considering sharing

Who would you share it with?

School DSL

Designated Safeguarding Lead

Headteacher

Senior leadership only

MASH

Multi-Agency Safeguarding Hub

Local Authority (social care)

Duty social worker or allocated worker

Other professional / agency

Specify below

Purpose of sharing

To safeguard a specific child

Known concern about a named child

To prevent harm to a child

Risk identified, no current harm confirmed

To support an investigation

Criminal or s.47 enquiry

To provide context to inform a decision

Background intelligence to assist assessment

🔒 Rule 2 of 7, GDPR is Not a Barrier

Is GDPR being cited as a reason not to share?

GDPR and the Data Protection Act 2018 do not prevent the sharing of information where there is a legitimate safeguarding purpose. If someone is citing GDPR as a reason to withhold information about a child at risk, that is not correct.

What the law actually says

Data Protection Act 2018 s.29(1) : the right to privacy in Article 8 ECHR is a qualified right. It can be overridden where necessary for the prevention of crime or the protection of children.

UK GDPR Article 9(2)(g) : processing of special category data is lawful where it is necessary for reasons of substantial public interest, which includes safeguarding functions under the Children Act 1989.

Crime and Disorder Act 1998, s.115

Any person may disclose information to a chief officer of police, a local authority, a probation board or authority, or a health authority if they reasonably believe the disclosure is necessary for the purposes of any function under the Act, which includes community safety and crime prevention functions. Schools are not CDA s.115 bodies, but police sharing with schools can be justified under public task or safeguarding grounds.

Serious Violence Duty (Police, Crime, Sentencing and Courts Act 2022)

Specified authorities, including police and local authorities, have a statutory duty to collaborate and share information for the purpose of preventing and reducing serious violence. This provides additional lawful basis for sharing in county lines, gang, and knife crime contexts.

Has GDPR been cited as a barrier to this sharing?

Yes, another party is refusing to share with me, citing GDPR

The frameworks above can be used to challenge this

Yes, I am uncertain whether sharing would breach data protection

Continue through this tool to assess

No, I'm assessing the decision proactively

Good practice, continue through the framework

🔒 Rule 3 of 7, Lawful Basis

Which lawful basis applies to this sharing?

UK GDPR requires at least one Article 6 lawful basis for any processing of personal data, including disclosure. For special category data (health, criminal history, ethnicity) an Article 9 condition is also needed.

Select the most applicable Article 6 lawful basis

Legal obligation (Article 6(1)(c))

A specific law requires you to share this. e.g. Serious Violence Duty; mandatory NRM referral; specific statute.

Public task (Article 6(1)(e)), most common for police

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. Your safeguarding, crime prevention, and child protection functions sit here.

Vital interests (Article 6(1)(d))

Sharing is necessary to protect the life of a person. Applies in emergency situations where consent cannot be obtained.

Consent (Article 6(1)(a))

The data subject (or parent/guardian for a child) has consented. Note: in safeguarding contexts, consent may not always be sought if doing so would put a child at risk or compromise an investigation.

Does the information include special category data? (e.g. health data, criminal convictions, ethnicity, religion)

Yes, the information includes special category data

An additional Article 9 condition is required

No, standard personal data only

Article 6 basis alone is sufficient

🔒 Rule 4 of 7, Necessary & Proportionate

Is the sharing necessary and proportionate?

Share only what is needed for the specific purpose. The privacy impact must be proportionate to the benefit of sharing.

The necessity and proportionality test

Ask: Could the safeguarding purpose be achieved with less information, or by other means that are less privacy-intrusive? If yes, use the less intrusive option. If the full information is genuinely necessary for the purpose, proceed.

Is sharing all of the information necessary, or could you achieve the purpose with less?

All of the information is necessary for the purpose

Cannot achieve the safeguarding aim with less detail

Only part of the information needs to be shared

I will limit the sharing to what is strictly necessary

Is the privacy impact of this sharing proportionate to the safeguarding benefit?

Yes, the benefit to the child's safety outweighs the privacy impact

No, the privacy impact may outweigh the benefit

Reconsider whether sharing is appropriate, consult your force DPO

Unsure, this is a borderline case

Seek advice from your force information governance team before sharing

Note what information you WILL share (limit to what is necessary)

🔒 Rule 5 of 7, Safety & Wellbeing First

What is the risk if you do NOT share this information?

Where sharing is necessary to protect a child from harm, the child's safety and wellbeing must take priority over any other consideration, including the data subject's right to privacy.

Golden Rule 5, the non-sharing risk test

"Base your information sharing decisions on considerations of the safety and well-being of the person and others who may be affected by their actions." When deciding whether to share, ask both: is sharing justified, and what harm might result from not sharing.

What could happen to the child if you do NOT share this information?

How would you characterise the risk of not sharing?

High risk, child is likely to suffer serious harm if information is not shared

Medium risk, information would significantly affect the professional's ability to protect the child

Lower risk, sharing would be helpful but the child is not in immediate danger without it

🔒 Rule 6 of 7, Consent Consideration

Should you seek consent before sharing?

Where possible, information sharing should be open and transparent. In many safeguarding situations, however, seeking consent first would be inappropriate.

Golden Rule 6, Working Together 2026

"Be open and honest with the family and/or the individual (and where appropriate the child) from the outset about why, what, how and with whom information will, or could be, shared, and seek their agreement unless it is unsafe or inappropriate to do so."

Would seeking consent before sharing be appropriate in this situation?

Yes, consent has been or can be obtained

The individual is aware and agrees to the sharing

No, seeking consent would put a child at greater risk

e.g. telling a suspected perpetrator that you are sharing information, alerting a suspect, or giving a vulnerable person the opportunity to prevent disclosure of abuse

No, seeking consent would undermine a criminal investigation

e.g. tipping off a suspect, compromising an ABE interview, alerting a county lines network

Not applicable, sharing is with a statutory partner under a lawful basis that does not require consent

e.g. public task basis, legal obligation, consent is not the relevant ground

Notes on consent / reason consent not sought (if applicable)

🔒 Rule 7 of 7, Record Your Decision

Record your decision and your reasons for it

Whether you share or not, you must record your decision, your reasoning, and the outcome. This is a non-negotiable obligation under Working Together 2026.

Golden Rule 7, Working Together 2026

"Keep a record of your decision and your reasons for it, whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose."

Officer name / warrant number

Date and time of decision

Force reference / crime number (if applicable)

Recipient confirmed

Final decision

Share the information, all conditions are met

Share limited information only, record what you will and will not share

Do not share at this time, record the reason

Seek further advice before deciding, record who you will consult

How the information will be shared (method)

Verbal then confirmed in writing

Recommended, call then email/letter within 24 hours

Secure email only

Via MASH portal / CHARMS / force system

Verbal only (emergency, document immediately after)

Any additional notes

Information Sharing Decision Tool