Recognised legitimate interests: Sharing information with the police

We have recently received a number of requests for support from schools and trusts in relation to information that has been requested by the police. In this article we explain the legal position and how this is going to change with the introduction of the Data (Use and Access) Act 2025. 

Schools and trusts are often approached by the police for information (such as CCTV footage, pupil records or copies of correspondence) to assist them as part of an investigation or prosecution. Schools and trusts should be aware of incoming changes to data protection law which will make information sharing between public authorities easier. 

Recognised legitimate interests

The Data (Use and Access) Act 2025 received Royal Assent in June 2025 and made some changes to data protection law in the UK, although some of its key changes are not yet in force.

One of the changes being introduced is a new lawful basis for processing personal data under Article 6 UK General Data Protection Regulation (UK GDPR). This change introduces Article 6(1)(ea) of the UK GDPR and provides a lawful basis for processing personal data where the processing is necessary for the purposes of a “recognised legitimate interest”. 

A “recognised legitimate interest” is a specified purpose for handling personal information that is in the public interest. These pre-approved purposes are the recognised legitimate interest conditions and do not require a legitimate interests assessment to be conducted.

There is a defined list of recognised legitimate interests being added to Annex 1 of the UK GDPR and these are:

• Where processing is necessary for the purposes of making a disclosure of personal data to another organisation for the purpose of performing their public task. 
• For the purposes of safeguarding national security or defence reasons.
• To respond to or deal with an emergency.
• To prevent, detect or investigate crime.
• To protect the physical, mental or emotional well-being of individuals to protect them from harm or neglect.

These recognised legitimate interests will be a key consideration for schools and trusts when sharing personal data with other public authorities or agencies. 

Whereas previously you may have relied on the “legitimate interests” lawful basis to share information with the police, the changes to the legislation mean that you will now not need to conduct a legitimate interests assessment prior to sharing information with the police. Therefore, if you want to share information with the police for the purposes of preventing or investigating crime, the most appropriate lawful basis will be the new recognised legitimate interests lawful basis under Article 6(1)(ea) UK GDPR.

Disclosures of special category data

If the information requested by the police includes special category data (such as information relating to health, sexuality or sexual orientation, race or religion), schools and trusts will need to identify an additional lawful basis for processing under Article 9(2) UK GDPR. In most cases, disclosures of special category data to the police will fall under Article 9(2)(g) UK GDPR — the disclosure is necessary for reasons of substantial public interest.

This lawful basis requires an additional condition to be met under Schedule 1 of the Data Protection Act (DPA) 2018 in order to be relied upon. The most relevant condition will be Schedule 1, Para 10, DPA 2018 - disclosures of special category data which are necessary for the purposes of the prevention or detection of unlawful acts; and where asking for the individual’s consent would prejudice those purposes.

Where the information requested includes criminal offence data (such as allegations that an individual has committed an offence) schools and trusts must comply with Article 10 of the UK GDPR. This means schools and trusts will need to also meet a relevant condition in Schedule 1 of the DPA 2018. The most relevant condition will be Schedule 1, Para 10, DPA 2018 (as set out above).

Victim information requests

We are also receiving requests for advice from schools and trusts relating to changes made the Police, Crime, Sentencing and Courts Act 2022. Section 44A of the Police, Crime, Sentencing and Courts Act 2022 came into force on 12 January 2026 and places obligations on the police to ensure that requests for information about victims are necessary and proportionate to achieve the purpose of preventing, detecting, investigating or prosecuting crime.

While the Police, Crime, Sentencing and Courts Act 2022 does not apply to schools and trusts, the accompanying Victim Information Request Code of Practice provides useful information about the way in which schools and trusts may handle requests for the police. In particular, it contains the following information:

• It confirms that there is no obligation to disclose relevant information
• It confirms you must have your own lawful basis for disclosure under data protection law
• It confirms that you can give handling instructions or conditions relating to onward sharing and storing.
• It confirms that you can insist on viewing on site if necessary.

Our top tips for schools

We want to help schools and trusts prepare for the changes made to data protection law and assist them with handling requests from the police. Our top tips are:

1. Keep an eye on the changes coming into force: The recognised legitimate interests lawful basis is not yet in force but is due to be brought into force early this year. Once it comes into force, you will be able to use this lawful basis for your disclosures to the police (and other public authorities).
2. Update your data sharing documents: You will want to ensure your data protection policies and procedures are up to date and refer to the recognised legitimate interests lawful basis where necessary.
3. Keep an audit trail: Request that the police document the request (such as by completing the Interim Third-party Material Request Form from the 2024 protocol) to evidence your decision-making process and ensure all relevant information is obtained from the police at the time the request is made.

Summary

We understand that handling requests from the police can be difficult, as schools and trusts want to balance the willingness to help law enforcement authorities against their data protection obligations; however, ensuring the steps outlined above are completed will help save time and resources, and will help to avoid confusion when dealing with police requests.

Support and resources

Our data protection support pack for schools and trusts contains detailed guidance on handling requests for information from law enforcement agencies and template audit trail documents to assist in dealing with these requests. These have been updated to reflect the changes introduced by the Data (Use and Access) Act 2025 and will be released once the changes to the law are brought into force.

With our data protection CPD programmes we’ll also help you develop the skills and confidence needed to handle data protection effectively, and with our other support packs equip you with the resources to do it efficiently.