View Working Together View Working Together

1.8 Draft GDPR - Information Sharing Protocol


In November 2019 this chapter was substantially updated and should be re-read.

This chapter is a draft.


  1. Introduction
  2. The General Data Protection Regulations
  3. Sharing and Recording a Disclosure
  4. Child Sex Offender Disclosure Scheme
  5. The Domestic Violence Disclosure Scheme

1. Introduction

Sharing information is vital for safeguarding and promoting the welfare of children to facilitate early intervention to ensure that children with additional needs receive the services they require and that children are protected from abuse and neglect.

Often, it is only when information from a number of sources has been shared and is then put together that it becomes clear that a child is at risk of suffering Significant Harm.

A key factor in many Serious Case Reviews has been a failure to record information, to share it, to understand the significance of the information shared, and to take appropriate action in relation to known or suspected abuse or neglect.

Practitioners are often concerned about sharing information and uncertain about when they can do so lawfully. This chapter provides a summary of the general principles to be followed by all practitioners on this issue.

2. The General Data Protection Regulations

The General Data Protection Regulations (GDPR) - implemented through the Data Protection Act 2018 states that ‘legal obligation’ and ‘public task’ (as defined in the GDPR) are relied on as the primary basis for processing information to establish whether or not there is a need to safeguard the welfare of a child. This means that, whilst families will be informed when personal data is being shared or processed, their consent will not be required.

When is the lawful basis for legal obligations likely to apply?  In short, when you are obliged to process the personal data to comply with the law.

What is the ‘public task’ basis? Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This can apply if you are either:

  • Carrying out a specific task in the public interest which is laid down by law; or
  • Exercising official authority (for example, a public body’s tasks, functions, duties or powers) which is laid down by law.

If you can show you are exercising official authority, including use of discretionary powers, there is no additional public interest test. However, you must be able to demonstrate that the processing is ‘necessary’ for that purpose.

‘Necessary’ means that the processing must be a targeted and proportionate way of achieving your purpose. You do not have a lawful basis for processing if there is another reasonable and less intrusive way to achieve the same result.

The significance of this change is that it is no longer necessary to seek consent to share information for the purposes of safeguarding and promoting the welfare of a child (i.e. removing the distinction between information sharing for the purposes of assessing need or child protection). It does, of course, continue to be good practice to inform parents / carers that you are sharing information for these purposes and to seek to work cooperatively with them. Agencies should also ensure that parents / carers are aware that information is shared, processed and stored for these purposes.

Information should only be shared on a “need to know” basis, i.e. necessary for the purpose for which they are sharing it and shared only with those people who need it.

Practitioners should ensure that the information they share is accurate, factual and up-to-date; where opinion is given, this should be made clear to the recipient.

Information should always be shared and stored securely.

3. Sharing and Recording a Disclosure

When a disclosure takes place practitioners should always share and record the following information:

  • When the disclosure was made;
  • Who made the disclosure;
  • Who the disclosure was made to;
  • How the disclosure was made;
  • What was disclosed.

4. Child Sex Offender Disclosure Scheme

The Child Sex Offender Review (CSOR) Disclosure Scheme is designed to provide members of the public with a formal mechanism to ask for disclosure about people they are concerned about, who have unsupervised access to children and may therefore pose a risk. This scheme builds on existing, well established third-party disclosures that operate under the Multi-Agency Public Protection Arrangements (MAPPA).

Police will reveal details confidentially to the person most able to protect the child (usually parents, carers or guardians) if they think it is in the child’s interests.

The scheme is managed by the Police and information can only be accessed through direct application to them.

If a disclosure is made, the information must be kept confidential and only used to keep the child in question safe. Legal action may be taken if confidentiality is breached. A disclosure is delivered in person (as opposed to in writing) with the following warning:

  • 'That the information must only be used for the purpose for which it has been shared i.e. in order to safeguard children;
  • The person to whom the disclosure is made will be asked to sign an undertaking that they agree that the information is confidential and they will not disclose this information further;
  • A warning should be given that legal proceedings could result if this confidentiality is breached. This should be explained to the person and they must sign the undertaking’ (Home Office, 2011, p16).
If the person is unwilling to sign the undertaking, the police must consider whether the disclosure should still take place.

5. The Domestic Violence Disclosure Scheme

See also: Domestic Violence and Abuse Procedures.

The Domestic Violence Disclosure Scheme (DVDS) commenced on 8 March 2014. The DVDS gives members of the public a formal mechanism to make enquires about an individual who they are in a relationship with, or who is in a relationship with someone they know, where there is a concern that the individual may be violent towards their partner. This scheme adds a further dimension to the information sharing about children where there are concerns that domestic violence and abuse is impacting on the care and welfare of the children in the family.

Members of the public can make an application for a disclosure, known as the ‘right to ask’. Anybody can make an enquiry, but information will only be given to someone at risk or a person in a position to safeguard the victim. The scheme is for anyone in an intimate relationship regardless of gender.

Partner agencies can also request disclosure is made of an offender’s past history where it is believed someone is at risk of harm. This is known as ‘right to know’.

If a potentially violent individual is identified as having convictions for violent offences, or information is held about their behaviour which reasonably leads the police and other agencies to believe they pose a risk of harm to their partner, a disclosure will be made.