Training: BCS Practitioner Certificate in Data Protection 
The Department for Education has opened a consultation on draft statutory guidance for the new information sharing duty introduced by the Children's Wellbeing and Schools Act, which will require safeguarding organisations to share information relevant to safeguarding and promoting the welfare of children from September 2026.
The consultation, which closes on 14 July 2026, seeks views on the draft guidance and an accompanying multi-agency data sharing agreement template. The duty, inserted as section 16LA of the Children Act 2004, will apply to organisations in England including local authorities, integrated care boards, NHS trusts, the police, prison and probation services, youth justice services, designated childcare and education agencies, and providers delivering services on their behalf, including GPs, dentists and other primary care providers. Organisations in scope must have regard to the guidance under section 16LA(6), and regulators and inspectorates may consider compliance when assessing effectiveness.
Under the duty, organisations that hold information about a child, or about another individual connected to a child, which they consider relevant to safeguarding or promoting the child's welfare must share it with another organisation in scope where doing so may facilitate the recipient's relevant functions. The duty applies both proactively and in response to requests, and the guidance makes clear that no statutory threshold, such as child protection enquiries under section 47 of the Children Act 1989, needs to be met before information is shared. The only limitation is where a practitioner judges that disclosure would be more detrimental to the child than not sharing, a determination the guidance says should be rare and cannot rest on absence of consent, parental objection, practitioner discomfort or data protection concerns alone.
A chapter of the draft guidance is devoted to what the Department describes as misinterpreted barriers to information sharing, addressing data protection, the common law duty of confidentiality, consent and the right to respect for private and family life. On data protection, the guidance states that the legislation does not prevent personal information being shared to safeguard children but provides a framework for sharing it in a fair, proportionate and lawful way. It identifies Article 6(1)(c) UK GDPR (legal obligation) as the lawful basis likely to apply to sharing under the duty, with public task under Article 6(1)(e) available to most public bodies and legitimate interests or the new recognised legitimate interests ground under Article 6(1)(ea) potentially appropriate for voluntary and private organisations.
For special category data, it emphasises the substantial public interest condition under Article 9(2)(g) combined with the safeguarding condition in paragraph 18 of Schedule 1 to the Data Protection Act 2018, and to the health and social care condition under Article 9(2)(h), with the Schedule 1 safeguarding condition also flagged for criminal offence data. Law enforcement authorities processing for law enforcement purposes remain subject to Part 3 of the DPA 2018.
The guidance states that section 16LA(7) provides that disclosure under the duty does not breach any obligation of confidence, meaning confidential patient information can be shared without consent and without the need to determine whether sharing is in the overriding public interest. It adds that consent is not only unnecessary as a lawful basis for safeguarding sharing but highly unlikely to be appropriate, given the imbalance of power between the parties, the possibility of withdrawal, and the risk that seeking consent from a suspected perpetrator would undermine safeguarding efforts. Practitioners are warned against presenting sharing as optional where it is not, with the guidance describing the practice of seeking consent and then sharing on a different lawful basis when refused as misleading and a false choice.
On governance, the draft guidance says each multi-agency safeguarding partnership should have a data sharing agreement sitting alongside its published arrangements, revised to take account of the new duty and reviewed regularly, with an overarching data protection impact assessment likely to be required before a partnership agrees a DSA. A template agreement is provided at Annex A.
Organisations must ensure safeguards, access controls and governance restrict access to personal information beyond what is necessary, limit onward use of information received under the duty to safeguarding purposes, and record decisions to share or not to share. The guidance is to be read alongside the ICO's data sharing code of practice and its ten-step guide to sharing information to safeguard children, and will replace the Department's existing non-statutory information sharing advice for safeguarding practitioners, with Working Together to Safeguard Children continuing to apply.
The Department is running a series of national webinars during the consultation period, with sessions tailored to health, education and early years, policing and justice, and local authority audiences, and is seeking responses from safeguarding organisations and their practitioners.
The consultation is available on the Department for Education's consultation site and closes on 14 July 2026 and can be accessed here: https://consult.education.gov.uk/mais-strategy-policy-and-programme-unit/statutory-guidance-for-information-sharing-duty/.
