It complements existing guidance from the ICO, the 10 step guide to sharing information to safeguard children.
The regulator makes clear this is not a standalone guide to safeguarding practice, but instead addresses data protection issues that arise when sharing information to safeguard.
What’s new?
There are no changes to the applicable law.
But this excellent new resource gives a dozen clear useful ‘case studies’, practical examples that explain what is expected when safeguarding responsibilities interact with data protection laws, covering situations such as:
- Sharing information about siblings at different schools
- Handling concerns in a school, and recording concerns and actions
- Receiving requests for information from the police
- Data sharing between old and new schools
- Information sharing between school and GP to safeguard a child or young person
Key takeaways include:
- Nothing in data protection law stands in the way of information sharing where it is justified and relevant for safeguarding. It can be more harmful not to share information that is needed to protect a child or young person.
- Where there is a risk of actual or potential harm, even when it is not known for certain how serious the risk is, under data protection law a school is able to share information as it is fair and proportionate because they have a legitimate cause for concern about the risk of harm to the child.
It reminds organisations that consent (one of the ‘lawful bases’ in data protection law for using personal data) is not required for sharing information in a safeguarding context. Appropriate lawful bases identified in the guidance for non-public schools when safeguarding are given as:
- Legal obligation – where required by a law to share information to safeguard a child
- Vital interests – sharing information in an urgent situation, where a child’s life or immediate wellbeing might be at risk
- Legitimate interests – a lawful basis available to educational organisations outside the public sector, such as charities and the private sector (including independent schools). In particular, the ICO reminds schools of an important change introduced by the Data (Use and Access) Act 2025 earlier this year; Schedule 4 enables organisations to rely on a ‘recognised legitimate interest’ when necessary for ‘responding to an emergency’ or ‘safeguarding a vulnerable individual’. When organisations rely on a ‘recognised legitimate interest’, they are not required to complete ‘behind the scenes’ data protection compliance work, called a Legitimate Interest Assessment, which is expected for other lawful legitimate interests. (The ICO will publish additional guidance on this new ‘recognised’ lawful basis during winter 25/26). It will be advantageous for education sector organisations to update their privacy policies/notices and internal data protection compliance documents to incorporate this change.
Sharing sensitive information when safeguarding
The new guidance reminds education sector organisations that when the information shared includes ‘special category data’ (such as health information) or ‘criminal offence data’, that in addition to identifying a lawful basis, they also need to meet a condition for processing under Article 9 of the UK GDPR (which is likely to be ‘health and social care’ in some situations, or a substantial public interest condition, such as ‘safeguarding of children and individuals at risk’).
It also helpfully looks at a situation which arise all too often in real life: dealing with complaints or objections from parents when information is shared for safeguarding. (See the Case Study titled “Concerns about sharing information about harm to a child when parents object”)
Reminder: other requirements in data protection law always apply
The new guidance includes reminders for organisations that when sharing information for safeguarding, to always do so securely.
It also reminds organisations to consider the capacity of any child or young person to exercise their own data protection rights when deciding whether to share information. It explains:
“[E]ven where the lawful basis for sharing information does not require the consent of the child or young person (and you use a different lawful basis instead), it’s good practice to listen to and consider their voice. Where it is safe and appropriate, you should explain decisions in a way the child or young person can understand, seek their perspective, and take their wishes into account alongside safeguarding considerations. This helps build trust, ensures transparency, and can improve the effectiveness of safeguarding interventions. However, whilst it’s good to take into account children’s views, this does not override your duties to report a child protection concern, even where a child disagrees.”
Here in Scotland, a person aged 12 or over “is to be presumed to be of sufficient age and maturity to have [capacity to exercise their own data protection right], unless the contrary is shown” (s208(3), Data Protection Act 2018)
There is also a reminder for organisations about their separate legal duty of confidentiality, which also must be considered when sharing information for safeguarding purposes. The ICO helpfully directs organisations to the applicable Scottish government guidanceon confidentiality.
Elsewhere in this new resource, they provide a comprehensive dropdown list of external guidance for the education sector in Scotland alongside a list of the applicable Scottish legislation which is a further welcome addition.
If you have any questions on any of the issues raised in the above article, please contact Sean Morris.