Deciding whether to share information

Rules for information sharing

The Data Protection Act is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately.

Share with consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information.

You may still share information without consent if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base your judgement on the facts of the case.

Consider safety and well-being: base your information sharing decisions on considerations of the safety and well-being of the person and others who may be affected by their actions.

Necessary, proportionate, relevant, accurate, timely and secure: ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up-to-date, is shared in a timely fashion, and is shared securely.

Keep a record of your decision and the reasons for it – whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.

Questions to asks

Is there a clear and legitimate purpose for sharing information?

  • Why do you or the other person want the information?
  • What is the outcome you are trying to achieve?
  • Could the aims be achieved without sharing the information?
  • Do not assume that you need to share everything.

Does the information enable a living person to be identified?

If the information is about an identifiable living individual, or could enable a living person to be identified when considered with other information, it is personal information and is subject to data protection law.

You should be open about what information you might need to share and why. 

However, it may not be appropriate to inform a person that information is being shared, or seek consent to this sharing. This is the case if informing them is likely to hamper the prevention or investigation of a serious crime, or put a child at risk of significant harm or an adult at risk of serious harm.

If the person was informed about how and with whom their personal information might be shared at the outset, it will usually not be necessary to inform them again as long as the use as described in the original notification is the same.

Is the information confidential?

Not all information is confidential. Confidential information is information of a private or sensitive nature that is:

  • not already lawfully in the public domain or readily available from another public source; and
  • has been provided in circumstances where the person giving the information could reasonably expect that it would not be shared with others.

You should seek consent where possible and respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement on the facts of the case, that lack of consent can be overridden in the public interest.

You do not always need consent to share personal information. There will be some circumstances where you should not seek consent, for example, where doing so would:

  • place a child at increased risk of significant harm; or
  • place an adult at increased risk of serious harm; or
  • prejudice the prevention, detection or prosecution of a serious crime; or
  • lead to unjustified delay in making enquiries about allegations of significant harm or serious harm.

Other things to consider:

  • Obtaining explicit consent is best practice. It can be expressed either verbally or in writing, although written consent is preferable since that reduces the scope for subsequent dispute.
  • You will need to consider whose consent should be sought. Does the person have the capacity to understand and make their own decisions on this occasion? If not, is someone else authorised to act on their behalf?
  • Consent must be informed, i.e. when people agree to information sharing, they must understand how much of their information needs to be shared, who will see it, why it is necessary to share the information and any implications of sharing or not sharing.
  • Consent can be withdrawn at any time.

Even where you do not have consent to share confidential information, you may lawfully share if this can be justified in the public interest.

Where consent cannot be obtained or is refused, or where seeking it is unsafe or inappropriate, the question of whether there is a sufficient public interest must be judged by the practitioner on the facts of each case. A public interest can arise in a wide range of circumstances.

Where you have a concern about a person, you should not regard refusal of consent as necessarily to mean that you cannot share confidential information.

In making the decision you must weigh up what might happen if the information is shared against what might happen if it is not, and make a decision based on professional judgement.

A competent adult has the right to make decisions which may put themselves at risk but which present no risk of significant harm to children or serious harm to other adults. In this case it may not be justifiable to share information without consent.

Are you sharing information appropriately and securely?

  • Only share what is necessary to achieve the purpose, distinguishing clearly between fact and opinion.
  • Share only with the person or people who really need to know the information.
  • Make sure the information is accurate and up-to-date.
  • Understand the limits of any consent given and especially if the information has been provided by a third party.
  • Check who will see the information and share the information in a secure way. For example, confirm the identity of the person you are talking to.
  • Ensure a conversation or phone call cannot be overheard.
  • Use secure email.
  • Establish with the recipient whether they intend to pass it on to other people and ensure that they understand the limits of any consent that has been given.
  • Inform the person to whom the information relates that you are sharing the information, if it is safe to do so, and if you have not already told them that their information may be shared.

Have you properly recorded your information sharing decision?

Record your information sharing decision and your reasons, including what information you have shared and with whom.

If, at any stage, you decide not to share information, you should record this decision and the reasons for it.

Scroll to Top