New duty on schools and academy trusts to share information to safeguard or promote a child’s welfare

The new information sharing duty: what has changed for schools and academy trusts?

Many schools and academy trusts have been uncertain whether data protection law requires a statutory threshold to be met before personal information regarding a child can be shared. In particular, there has been uncertainty whether personal data can be shared where there are concerns as to a child’s welfare or emerging needs rather than an immediate risk of harm.

Following the passage of the Children’s Wellbeing and Schools Act 2026, with effect from 30th September 2026, the Children Act 2004 has been amended to clarify the circumstances in which schools and academy trusts must share personal data. Section 16LA of the Children Act creates a statutory duty to share information with other organisations coming under the duty where this is necessary to safeguard or promote a child’s welfare, including where there are concerns relating to early help, prevention of harm and unmet needs. The organisations coming under the duty include other schools (including independent schools), the local authority, NHS trusts and primary care providers, and the police.

Where a school considers that it holds information relevant to safeguarding or promoting a child’s welfare, it must share the information with other organisations that are subject to section 16LA if the disclosure may help the organisation to exercise its functions. These functions may include assessing risk, making decisions, providing support or taking actions to safeguard and promote the welfare of a child. The duty to share information applies both when the information is identified and when a request is received from another organisation who has a section 16LA duty.

The section 16LA duty can also extend to sharing information about individuals connected to a child including a parent, carer or peer where that information is relevant to a child’s safety or welfare.

Where information is shared in line with a section 16LA duty, there is no requirement to obtain consent or to consider whether sharing is in the overriding public interest. However, if it is determined that sharing information would be more detrimental than beneficial to a child, schools can justify not sharing information. The Government’s statutory guidance sets out that this exception should only be used in exceptional circumstances.

What does this mean from a data protection perspective?

Section 16LA provides schools and academy trusts with a clear lawful basis under Article 6(1)(c) of UK GDPR to process personal data in accordance with a legal obligation. An appropriate condition must still be identified when processing special category data.

Although UK GDPR allows personal data to be processed on the basis of consent, academy trusts and maintained schools should not rely on consent when sharing information in accordance with section 16LA. It can be questioned whether consent can be freely given in such circumstances and consent can be withdrawn at any stage. Moreover, relying on consent may undermine safeguarding efforts and increase the risk of harm.

However, where safe to do so, the statutory guidance recommends that schools be open and transparent with children and families about why information is being shared, what may be shared and how it will be used. Any discussions should not suggest that sharing is optional or that parental agreement will determine whether information is shared.

Schools should also distinguish clearly between fact, opinion and professional judgement when sharing personal data. A safeguarding referral based on a genuine concern is a record of the information and judgement available at that time. It is not necessarily a finding that an allegation is true. Additional information may need to be added to the record when it comes to light but contemporaneous professional judgements and opinions need not be amended in retrospect.

What should maintained schools and academy trusts do?

• Review their safeguarding procedures, privacy notices, records of processing activities and information sharing arrangements to include the new section 16LA duty and the Article 6(1)(c) lawful basis.

• Ensure the designated safeguarding leads (DSLs) and deputy DSLs understand the wider circumstances in which section 16LA applies and that parental consent is not required to share information where the duty applies.

• Ensure that decisions to share or withhold information are recorded, including the assessment of relevance, how sharing may assist the recipient and any potential detriment to the child.

• Local data sharing agreements and associated data protection impact assessments may also require revision.

If you would like to discuss any aspect of this article further, please contact our Education team on 0113 244 6100.

You can also keep up to date by following Wrigleys Solicitors on LinkedIn.

The information in this article is necessarily of a general nature. The law stated is correct at the date (stated above) this article was first posted to our website.

Specific advice should be sought for specific situations. If you have any queries or need any legal advice, please feel free to contact Wrigleys Solicitors.