Multi-agency information sharing protocol

1. Purpose and Principles

Safeguarding children requires timely, accurate, and confident information sharing. Practitioners must be clear that data protection legislation is not a barrier to sharing personal information where there are concerns about the safety or welfare of a child. This principle is reinforced through statutory guidance in Working Together 2023, the UK GDPR, and the Data Protection Act 2018.

​

The London Safeguarding Children Partnership (LSCP) has clarified through recent correspondence that some national interpretation, including within inspection activity, has created confusion by over‑emphasising consent-based sharing, despite statutory guidance stating otherwise. This updated protocol ensures that Croydon practitioners are supported to make confident, lawful, and timely information-sharing decisions.

​

2. Statutory Basis for Information Sharing

​

Working Together 2023 makes clear:

• Practitioners must be proactive in sharing information as early as possible to help identify, assess, and respond to risk. This applies both when problems are emerging and where a child is already known to children’s social care.

• The Data Protection Act 2018 and UK GDPR support the sharing of relevant information for safeguarding, and concerns about sharing information must not be allowed to stand in the way of protecting children. 

​​

The ICO further clarifies that while consent is one possible lawful basis, it is not required in safeguarding contexts, and in most safeguarding scenarios a more appropriate lawful basis will apply. 

​

Lawful Bases Frequently Used in Safeguarding

• Public Task – performance of a task in the public interest

• Legal Obligation – compliance with a statutory requirement

• Vital Interests – to protect life
  These do not require consent.

​​

3. Consent: Clarification and Correct Use

The LSCP review of ILACS (Inspecting Local Authority Children's Services) reports across London found widespread inconsistency, including repeated suggestions that consent should normally be obtained before sharing information. LSCP notes that this is contrary to statutory guidance and risks undermining timely safeguarding responses. 

​

When consent is not required

​​​​Consent is not necessary when information is shared:

• To safeguard and promote the welfare of a child

• To prevent significant harm

• To fulfil a public task or legal obligation

Consent is also not appropriate where:

• It could delay urgent action

• Seeking consent would place a child at additional risk

• The threshold for consent (specific, time‑limited, freely given, revocable) cannot be met

​

4. Working Openly With Families

Both LSCP and Ofsted agree that good practice includes working collaboratively and transparently with families where possible. Ofsted’s response emphasises that openness is important but must not delay safeguarding action.

​

Practitioners should therefore:

• Inform families where this is safe, appropriate, and will not delay action

• Clearly record the rationale where information is shared without informing parents due to safeguarding risk or urgency

• Ensure management oversight for such decisions, as reflected in Ofsted’s position. 

​

5. Understanding and Responding to Sector Confusion

National uncertainty has been reinforced by:

• Mixed interpretations in inspection activity

• The Judicial Review into the Haringey judgement, which contributed to concerns about sharing without parental consent.

• Practitioner anxiety about the lawful basis for information sharing, highlighted in the Foundations evaluation of MASH practice.

​​

This protocol directly addresses those concerns by restating the clear statutory direction: information must be shared proportionately and without delay when safeguarding is at stake.

 

6. Practice Expectations for Croydon Practitioners

You must share information when:

• A child is at risk of harm, exploitation, neglect, or abuse

• There is professional concern, even if the threshold for statutory intervention is not yet met

• Another agency requires information to assess risk or deliver support

• You have additional information that would help another agency understand the child’s circumstances

 

You do not need consent when:

• A safeguarding concern exists (at any level of need)

• Seeking consent would create delay

• Consent cannot be freely given or maintained

​​

Recording requirements

• Document the concern

• Document what was shared, with whom, and why

• Document why consent was not sought or obtained

• Document management oversight where appropriate

​

7. Alignment with London Safeguarding Children Procedures (CP9)

The London Procedures emphasise:

• Information sharing is essential for early identification and response

• Data protection law is not a barrier

• Practitioners have never been sanctioned for sharing information to safeguard children

• The welfare of the child is the overriding consideration

 

Your updated local guidance is now fully aligned with this position.

​

8. Escalation and Professional Challenge

Where practitioners encounter:

• Agencies wrongly stating that consent is required

• Delay caused by misunderstanding of data protection law

• Conflicting expectations in inspection or audit practice

 

They must escalate through line management and, if necessary, through CSCP’s escalation pathway. The LSCP executive has formally challenged Ofsted on this inconsistency, reinforcing the legitimacy of local professional challenge.