Since 30 September, schools have a legal duty to share safeguarding and welfare information. Here's what that changes in practice, and what DSLs and DPOs should be doing now.
The Children's Wellbeing and Schools Act added a new section 16LA to the Children Act 2004: a duty to share information to safeguard children and promote their welfare. It came into force on 30 September 2026, and the DfE has published statutory guidance to go with it.
Schools and colleges are covered, along with local authorities, the police, health, probation and youth justice. The guidance is statutory, so you're expected to follow it unless there are exceptional circumstances, and inspectors may look at whether you have. It sits alongside Keeping Children Safe in Education and Working Together to Safeguard Children, rather than replacing them.
The duty isn't retrospective. It applies to decisions made from 30 September onwards, though you can still share older concerns that were never passed on.
What's actually changed
The short version: if you hold information that's relevant to a child's safety or welfare, and sharing it may help another organisation covered by the duty to do its job, you must share it. The same applies when another organisation asks you for it.
A few points are worth spelling out, because they're where practice has been most cautious:
-
There's no threshold. You don't need to wait until a concern reaches child protection level. The duty covers early help, prevention and unmet need too.
-
It's not just about the child. Information about a parent, carer, sibling or peer is covered if it's relevant to the child, such as a parent's mental health or alcohol use, or links to older young people involved in exploitation.
-
It covers children who may harm others. You can't hold back information just because the child it's about isn't at risk themselves.
-
Confidentiality isn't a barrier. A disclosure made under the duty doesn't breach any duty of confidence.
-
You don't need a data sharing agreement first. That matters most when a child moves to another area, where the guidance expects you to pass concerns on.
In practice, the school is often the agency that notices first: changes in attendance, behaviour or how a child presents. The guidance's examples include a SENCO sharing wellbeing concerns with a Family Hub without parental consent, and a primary school whose concerns, put together with the GP's and the police's, revealed possible sexual abuse.
When you can hold back
There's one exception: when sharing would be more harmful to the child than not sharing. The guidance says this should be rare, and it will usually mean sharing would put the child at immediate risk, prejudice a police investigation in a way that harms a child, or breach a family court order.
It's just as clear about what doesn't count. You still have to share if your only concern is:
-
you don't have consent from the child or family
-
a parent is unhappy about it, or you're worried about a complaint
-
you feel unsure or uncomfortable (the answer is to ask your DSL, not to hold back)
-
data protection
Even when the exception applies, you can often share part of the picture. In the guidance's example of a child hidden from an abusive parent, the practitioner shares everything except the child's location, records what was held back and why, and reviews the decision regularly.
Data protection still applies, but consent isn't the test
The duty doesn't switch off UK GDPR. It gives you a clearer legal footing. The guidance points to legal obligation (Article 6(1)(c)) as the likely lawful basis for sharing under the duty, with public task as the usual alternative for schools. For special category data, such as health or SEND information, it suggests the substantial public interest condition for safeguarding (Article 9(2)(g) with Schedule 1 paragraph 18 of the DPA 2018). The usual principles still apply:
-
Share what's needed, not everything. If someone asks for a whole file or access to your system, you can send the relevant extract instead.
-
Separate fact from opinion. Make it clear when you're passing on a professional view rather than an established fact.
-
Keep it secure. Use the agreed routes, not personal email.
-
Keep records. Note what you shared, with whom and why, and also when you decided not to share.
-
Stick to the purpose. Information you receive under the duty is for safeguarding and welfare, not anything else. The guidance specifically rules out using it for predictive analytics.
The consent point will need the biggest change in habits for many schools. Consent is almost never the right lawful basis here, and the guidance says you shouldn't ask for it if you're going to share anyway. Asking and then sharing after a "no" offers families a false choice. Instead, be open with children and parents about what you're sharing and why, unless doing so would put the child at risk. The DfE is producing materials for families to help with this.
What to do now
Most of this sits with the DSL, but several items need the DPO too. It's worth getting them in a room together.
Brief your safeguarding team and staff. The key messages are: no threshold, consent isn't the test, and if in doubt, talk to the DSL rather than sit on it.
-
Update your child protection policy to reference the duty and how staff should share and record concerns.
-
Update your privacy notices. Families should be able to see that you share safeguarding and welfare information under a legal duty, and when.
-
Update your record of processing activities. Add the sharing, with its lawful basis and Article 9 condition.
-
Check your local safeguarding partnership's arrangements. Partnerships have to revisit their data sharing agreements for the duty, and some may agree routine sharing, such as attendance data. Find out which route to use for which kind of information, especially urgent concerns.
-
Have a process for incoming requests. Who handles them, how you check the request has enough context, and how you decide what's relevant.
-
Review your templates and scripts. Remove wording that asks parents for consent where you'd share anyway.
-
Record every decision. Make sure your safeguarding system captures the rationale for sharing or not sharing.
-
Plan for students turning 18. The duty stops at 18, so sixth forms and colleges need a clear route for adult safeguarding.
One more thing to watch: a separate mandatory reporting duty for child sexual abuse is on its way under the Crime and Policing Act 2026, with its own guidance. It'll sit alongside this duty, not replace it.
The bottom line
The duty takes away a lot of the hesitation that's held back safeguarding information in the past. That's good for children. But it also means more personal data moving between more organisations, so the basics matter more than ever: share only what's relevant, keep it secure, and write down why. Schools where the DSL and DPO work together on this will find it much easier to get right.
Sources: Information sharing to safeguard children and young people