What changed in 2026
For years the main reference was the DfE’s non-statutory advice, “Information sharing: advice for practitioners providing safeguarding services”, last updated in April 2024. Working Together 2026, published in March, still describes it as non-statutory advice (paragraph 34).
That changed in September 2026:
- 30 September 2026. The information sharing duty in new section 16LA of the Children Act 2004, added by the Children’s Wellbeing and Schools Act 2026, came into force.
- 10 September 2026. The DfE updated the same GOV.UK page, now titled “Information sharing to safeguard children and young people”, as statutory guidance on the duty, with two template data sharing agreements. It replaces the 2024 advice. Organisations covered by the duty must have regard to it, and the DfE says inspectorates may consider compliance.
The duty covers designated childcare or education agencies, defined by reference to the 2018 relevant agency regulations, which include schools and colleges. It also covers local authorities, the police, health bodies and youth justice, among others. It applies to situations arising after 30 September 2026 (paragraph 4).
The duty in plain terms
If your school holds information about a child, or about someone connected to a child, that you consider relevant to safeguarding or promoting the child’s welfare, you must share it with another organisation covered by the duty if you consider it may help that organisation with its safeguarding or welfare work. The same applies when another covered organisation asks you for it. Sharing under the duty doesn’t breach any duty of confidence.
The DfE says there is no threshold to meet first. Information must be shared where it relates to early help, prevention and unmet need, not only significant harm (paragraph 2).
The three tests
Before sharing, the guidance asks (paragraph 14):
- Relevance. Does the information bear on the child’s safety or welfare?
- May facilitate. Is the recipient covered by the duty, and could sharing help it assess need, make a decision, give support or take action?
- Detriment. Would sharing be more detrimental to the child than not sharing? Can you reduce the risk, for example by leaving out a location?
The one exception
The duty doesn’t apply if sharing would be more detrimental to the child than not sharing. The guidance says this should be rare (paragraph 9). It usually means sharing would put the child at immediate risk of harm, would harm a police investigation in a way that’s worse for a child, or would breach a family court order (paragraph 10).
These are not reasons to withhold (paragraph 11):
- not having consent from the child or family
- a parent being unhappy, or fear of a complaint
- a member of staff feeling unsure or uncomfortable, who should get advice from the DSL instead
- data protection, which “should not usually” require information to be withheld
Consent
You don’t need consent to share. The DfE says consent is just one of seven lawful bases in UK GDPR, and “highly unlikely to be the most appropriate choice” for sharing under the duty (paragraph 41). Working Together 2026 also says it isn’t necessary to seek consent where there is a lawful basis (paragraph 32).
The guidance goes further: don’t ask for consent if you are going to share anyway. Asking, then sharing on another basis when the family says no, is “misleading” and gives them a false choice (practice box after paragraph 45).
Being open is still expected. Tell the child and family what you are sharing and why, unless that would increase the risk or isn’t practicable, and record your decision (paragraphs 33 and 44).
The data protection basis
KCSIE 2026 calls the Data Protection Act 2018, UK GDPR and the Data (Use and Access) Act 2025 together “data protection laws” (paragraph 104). For safeguarding, schools usually rely on:
| What you are sharing | What you need |
|---|---|
| Any personal data | A lawful basis under Article 6 of UK GDPR. Under the duty, legal obligation (6(1)(c)) is likely to apply, and public task (6(1)(e)) applies to most public bodies |
| Special category data, such as health or ethnicity | An Article 9 condition as well, usually 9(2)(g), substantial public interest, relying on the safeguarding of children and of individuals at risk condition in DPA 2018 Schedule 1, paragraph 18 |
| Criminal offence data | Official authority, or a Schedule 1 condition such as paragraph 18 |
The Schedule 1 condition applies where the sharing is necessary to protect a child from neglect or harm, or to protect their wellbeing, and consent can’t be given, can’t reasonably be obtained, or asking would prejudice that protection.
Schedule 8, paragraph 4 of the DPA 2018 has the same wording, but it applies to law enforcement processing under Part 3 of the Act, mainly by the police. Schools share under UK GDPR and Part 2, so Schedule 1 paragraph 18 is the one to name in your records.
The data protection principles still apply: share only what is necessary, keep it accurate, make clear what is fact and what is opinion, and send it securely (paragraph 38).
What KCSIE 2026 asks of schools
KCSIE says staff should share information as early as possible and should not assume someone else will (paragraphs 62 and 142). Governing bodies should make sure there are clear arrangements for sharing within the school and with children’s social care and safeguarding partners (paragraph 141), and that staff understand the processing conditions (paragraph 146). If in doubt, staff speak to the DSL (paragraph 63).
In practice:
- Record each decision to share or not share, and why. The guidance expects this (paragraph 33).
- Share extracts or summaries rather than whole files where that’s enough (paragraph 32).
- Acknowledge information you receive, and tell the sender what you did with it.
For referrals to children’s social care, see how to make a safeguarding referral. For moves between schools, see transferring child protection files.