Safeguarding vs. GDPR: Navigating Emergency Police Disclosures and Data Sharing
When the police or social services ask for information about a pupil, should schools share it immediately, insist on a warrant, or refuse because of GDPR?
For many school staff, an unexpected telephone call from the police or children's social care can create an uncomfortable dilemma. A police officer requests a pupil's home address. A social worker urgently needs attendance information. The Local Authority Designated Officer (LADO) asks for records relating to an allegation against a member of staff. The information may be sensitive. The circumstances may be urgent. The person requesting it may insist that a child is at risk.
But what about GDPR? Should the school obtain parental consent? Does the police officer need a warrant? Could the school face an ICO investigation for disclosing confidential information?
The central message is simple: data protection law should never be used as an excuse for failing to protect a child.
The UK GDPR and Data Protection Act 2018 provide lawful routes for sharing personal information when necessary to safeguard children. The challenge is understanding when disclosure is appropriate, what information can be shared and how the decision should be recorded.
1. Safeguarding and GDPR: Partners, Not Opponents
One of the most persistent misunderstandings in schools is that GDPR prevents staff from sharing information with external agencies. It does not.
The Department for Education's Keeping Children Safe in Education guidance makes clear that fears about sharing information must not obstruct the promotion of children's welfare and protection of their safety. Similarly, the DfE's Information Sharing: Advice for Practitioners Providing Safeguarding Services explains that information sharing is essential to effective safeguarding.
The legal principle is not that safeguarding abolishes data protection responsibilities. Rather, the law enables necessary and proportionate sharing for safeguarding purposes. Where a child is in immediate danger, the school should act promptly. Staff should not delay an essential disclosure simply because a parent has not consented or because the school's Data Protection Officer is unavailable. Equally, urgency does not justify giving unrestricted access to entire pupil files when a limited disclosure would meet the safeguarding need.
2. Understanding the Legal Basis for Disclosure
UK GDPR requires a lawful basis for processing personal data, including disclosure to another organisation. For schools, the most relevant Article 6 provisions include:
Article 6(1)(e) – Public Task
Processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.
This will often be an appropriate lawful basis for a maintained school or academy sharing information in connection with its statutory safeguarding responsibilities, where the necessary legal foundation exists.
Article 6(1)(c) – Legal Obligation
Processing is necessary to comply with a legal obligation.
This may apply where legislation imposes a sufficiently clear obligation to provide information. Not every police request creates such an obligation.
Article 6(1)(d) – Vital Interests
Processing is necessary to protect someone's vital interests.
This can be relevant where a person's life or physical safety is at stake. However, it should not be treated as the routine lawful basis for every safeguarding disclosure. Public task or legal obligation may be more appropriate.
Where information includes special category personal data, such as health information, disability-related information or certain other particularly sensitive details, an additional Article 9 condition is required. Depending on the circumstances, relevant conditions may include:
Article 9(2)(g), substantial public interest, together with an applicable condition in Schedule 1 of the Data Protection Act 2018.
Schedule 1, paragraph 18, safeguarding of children and individuals at risk, where its statutory requirements are satisfied.
Article 9(2)(c), vital interests, in the limited circumstances where the individual is physically or legally incapable of giving consent.
Information about criminal allegations and offences may also engage Article 10 and the relevant provisions of the Data Protection Act 2018.
A practical point: schools must distinguish between their lawful basis under Article 6, any additional condition required under Article 9 or Article 10, and the statutory power or duty supporting the disclosure.
The Data (Use and Access) Act 2025 has amended aspects of the UK's data protection framework, but it has not introduced a blanket exemption allowing schools to disclose whatever information the police request.
3. Do the Police Need a Warrant?
Not necessarily. There is an important distinction between a police officer requesting information, a legally compulsory demand for information and a search or seizure requiring appropriate legal authority. Police officers routinely request information to assist investigations, locate missing children or protect individuals at risk.
Schools may be able to disclose information lawfully without a warrant or court order. For example, the police may urgently need to establish the whereabouts of a pupil believed to be in immediate danger. In such circumstances, insisting on a warrant before considering disclosure could cause an unnecessary and potentially dangerous delay.
However, a police uniform, warrant card or telephone call does not automatically give an officer an unrestricted right to inspect school records.
Staff should establish:
Who is requesting the information and whether their identity can be verified.
Why the information is needed.
Whether the request concerns an immediate safeguarding risk, an investigation or another purpose.
What specific information is required.
Whether the police are relying on a statutory power or making a voluntary request.
Section 29 of the Data Protection Act 2018, sometimes quoted in connection with police requests, should not be confused with the former section 29 of the Data Protection Act 1998. Under the current framework, the relevant crime and taxation exemption is found principally in Schedule 2, paragraph 2, of the 2018 Act. That exemption can disapply certain data protection provisions where applying them would prejudice specified purposes. It does not itself compel a school to disclose information or provide a standalone lawful basis for disclosure.
4. When Parental Consent Is Not Needed
Another common misconception is that parents must always give permission before a school shares information about their child. This is incorrect. Where a school has an appropriate lawful basis and the necessary conditions are satisfied, parental consent is not required simply because personal information is involved. Indeed, seeking parental consent could sometimes increase the risk to a child.
Consider a pupil who discloses suspected abuse within the family. Informing the parents that the school intends to contact children's social care could expose the pupil to intimidation, retaliation or further harm. In such circumstances, the school should follow its safeguarding procedures and share relevant information with the appropriate professionals without seeking parental permission where doing so is necessary and lawful.
The same principle may apply to disclosures involving:
Suspected child abuse or neglect.
Children missing from education where safeguarding concerns arise.
Children at risk of exploitation or serious violence.
Police investigations involving immediate threats to safety.
Allegations against adults working with children.
This does not mean parents should never be informed. Decisions about parental involvement should be based on the circumstances, the child's welfare and relevant safeguarding advice.
5. Sharing Information with the LADO
The Local Authority Designated Officer has a specific role in managing allegations concerning adults who work with children. Where an allegation meets the relevant safeguarding threshold, schools should follow the procedures set out in Keeping Children Safe in Education and local safeguarding arrangements. This may require prompt contact with the LADO and the disclosure of relevant information concerning the allegation. Parental or employee consent is not necessarily required.
The school should not refuse a necessary and lawful safeguarding disclosure merely because the allegation concerns confidential employment information or because the individual objects.
Nevertheless, the information disclosed should be relevant to the allegation and the LADO's functions. A request for one incident report does not automatically justify sending an employee's complete personnel file.
The school must also preserve confidentiality, restrict unnecessary circulation and ensure that allegations are handled fairly.
6. Three Situations Every School Should Understand
Scenario A: A Missing Child
The police telephone a secondary school seeking the last known whereabouts, attendance information and emergency contact details for a pupil believed to be at serious risk. The school verifies the officer's identity and establishes the urgency.
Recommended response: Share the information necessary to assist the police in protecting or locating the child, using the appropriate lawful basis and a secure method of communication. Record the decision as soon as practicable.
Scenario B: A Historical Police Investigation
An officer requests the entire school file of a former pupil in connection with an investigation into an incident several years earlier. No immediate safeguarding risk has been identified.
Recommended response: Request clarification of the purpose, specific information needed and legal basis or authority being relied upon. Consider whether a limited voluntary disclosure is lawful and proportionate, or whether formal legal authority is required. The school should not automatically refuse, but neither should it automatically release the entire file.
Scenario C: An Allegation Against a Member of Staff
A pupil makes a serious allegation against a teacher. The school identifies that the allegation meets the threshold for referral to the LADO.
Recommended response: Follow the school's safeguarding and allegations procedures, contact the LADO within the applicable timescale and share the relevant information. Do not delay necessary safeguarding action while waiting for the employee's consent or for a routine data protection review.
7. The Audit Trail: Recording What Was Shared and Why
Urgent sharing does not remove the need for accountability. Under Article 5(2) of UK GDPR, schools must be able to demonstrate compliance with the data protection principles.
An appropriate record of significant external disclosures is therefore an important part of the school's information governance arrangements. The record should normally include:
Date and time: When the request was received and when information was disclosed.
Requesting organisation: Police force, local authority, LADO or other agency.
Identity and verification: Who requested the information and how their identity or authority was established.
Purpose: Why the information was requested and any identified safeguarding risk.
Information disclosed: Precisely which records, documents or details were shared.
Legal justification: The applicable Article 6 lawful basis, any Article 9 or Article 10 condition, and relevant statutory power, duty or exemption.
Decision and authorisation: Who decided to share the information and, where applicable, who approved it.
Method of transfer: How the information was communicated or transmitted.
Restrictions or follow-up: Any conditions, outstanding verification, subsequent action or decision not to share particular information.
Schools should also record refusals or partial disclosures where these involve significant safeguarding or legal considerations.
For Insight customers, I recommend recording these decisions in the Information Governance Master Record, alongside other significant data protection and information governance activities.
Where safeguarding information is involved, the relevant safeguarding record should also be updated, with appropriate links between records and without unnecessary duplication of sensitive details.
8. What About Emergencies Outside School Hours?
Safeguarding emergencies do not always occur during normal working hours. A police request may arrive during the evening, at a weekend or during a school holiday. Schools should therefore have arrangements that identify who can make urgent information-sharing decisions when the Headteacher, Designated Safeguarding Lead or Data Protection Officer is unavailable.
Staff should understand that they do not necessarily need to wait for the DPO before sharing information essential to protecting a child. The DPO's role is to advise and monitor compliance, not to act as the sole authorising officer for every safeguarding disclosure.
Where an urgent decision is taken without the usual consultation, the reasons should be documented and the appropriate senior staff informed afterwards.
9. Secure Sharing Still Matters
Even where disclosure is lawful, schools should take reasonable steps to protect information in transit. Depending on urgency and circumstances, this may involve:
Confirming the requester's identity through an independently verified telephone number.
Using established secure information-sharing platforms or approved encrypted communications.
Providing only the relevant information rather than unrestricted access to systems.
Ensuring records are sent to verified recipients.
Keeping appropriate evidence of what was transferred.
In a genuine emergency, the need to protect life or prevent serious harm may justify using the safest practicable method available rather than delaying essential information while an ideal method is arranged. The decision should be proportionate to the circumstances and recorded.
10. A Practical Message for School Leaders
Schools should not expect frontline staff to interpret complex legislation during an emergency without preparation. Headteachers, governing bodies and academy trustees should ensure that their schools have clear procedures covering police requests, safeguarding referrals and other disclosures to external agencies. Staff should know when to involve the DSL, when to seek DPO advice, how to verify requests and how to document decisions.
Training should distinguish between genuinely urgent safeguarding situations and routine requests that allow time for further checks.
The aim is not to make information sharing unnecessarily bureaucratic. It is to enable confident, timely and lawful decisions.
Final Thoughts: Protect the Child, Share Appropriately, Record the Decision
The most important lesson is that GDPR is not a barrier to safeguarding. Schools can, and in appropriate circumstances must, share personal information to protect children and fulfil their statutory responsibilities.
The absence of parental consent does not automatically prevent disclosure. Nor does the absence of a police warrant. But neither should schools assume that every request from an official body must be met without question.
The right approach is to establish the need, identify the legal justification, share what is necessary and maintain a clear record of the decision.
When schools understand these principles, safeguarding and data protection work together rather than against one another.
Insight Management Services and Information Governance Ltd
Insight provides independent information governance, data protection and related compliance advice to schools, academies and multi-academy trusts. For further advice on police disclosures, safeguarding information sharing, data protection procedures and recording information governance decisions, contact Insight.
Comments