The Children's Wellbeing and Schools Act introduced a new information sharing duty, commencing on 30 September 2026. Statutory guidance published on 10 September 2026 sets out what practitioners should share, and when, for the purposes of safeguarding and promoting the welfare of children. 

For Data Protection Officers (DPOs) in schools and academy trusts, the duty brings both practical tasks and some important opportunities for clarity.

A specific statutory obligation: Why this matters for lawful basis

Practitioners had told government that the complexity of legislation left them unsure about when they could share information, particularly where concerns related to a child's welfare or emerging need rather than harm. There was confusion about whether a specific statutory threshold, such as a child protection enquiry under section 47 of the Children Act 1989, had to be met before information could be shared.

Section 16LA of the Children Act 2004 now places a clear legal obligation on practitioners to share information where the criteria are met. This provides a straightforward route to identifying lawful basis under UK GDPR, specifically Article 6(1)(c) (legal obligation).

Previously, schools relying on Article 6(1)(e) (public task) had a sound basis, but it was harder to point to the specific provision that compelled sharing. For schools operating under the duty, the legal obligation basis provides a more precise foundation, particularly for early help referrals where the public task basis might previously have felt uncertain.

For special category data, practitioners should consider Article 9(2)(g), where processing is necessary for reasons of substantial public interest relying on Schedule 1(18) of the DPA 2018, and Article 9(2)(h), where processing is necessary for the purpose of health or social care systems and services.

This change has implications for your records of processing activity (ROPA) and your privacy notices. Both documents need to accurately reflect the lawful basis on which information is now being shared.

The transparency trap: The illusion of consent

This is where, in our experience, schools most commonly find themselves in difficulty. A well-meaning practitioner sits down with a parent before making an early help referral and explains why. The conversation is conducted in a way that implies the parent has a choice. The parent feels consulted. But they also, quite understandably, believe that their agreement is what determines whether the referral is made. That's the illusion of consent, which the statutory guidance addresses.

The term "consent" has various meanings depending on the context and how practitioners work within a particular environment, and where different meanings and expectations are conflated and confused, this can function as a barrier to appropriate information sharing.

Transparency with children and families does not require obtaining consent to share information. Where public task or legal obligation is the lawful basis, any discussion with parents or children should avoid implying that their agreement is what determines whether information is shared, and practitioners should avoid seeking consent if they intend to share information in any case.

Seeking consent and then proceeding to share information using a different lawful basis upon consent being refused is misleading and presents the individual with a false choice. Organisations must choose and be clear on the most appropriate lawful basis from the beginning.

Helping families to understand: Don't wait for the government's materials

The statutory guidance signals that the government will produce materials for distribution among children and families to explain an organisation's obligation under the information sharing duty in an engaging and accessible manner. DPOs and designated safeguarding leads should watch for these materials when they are published. But don't wait for them.

Parents who are surprised that information has been shared, or who feel that sharing happened without their knowledge, are far more likely to raise complaints, assert data subject rights, or challenge the accuracy of records. All of those issues arrive on the DPO's desk.

The guidance recognises that effective engagement of children and families is critically important. Where safe to do so, practitioners should be open and transparent about why information is shared, what might be shared and how it will be used. Building understanding and trust supports better outcomes and helps families to participate meaningfully in support and intervention.

The guidance sets out clearly what this looks like in practice: practitioners should explain the purpose of sharing; describe what information will be shared and with whom; be clear about limits to confidentiality; avoid presenting sharing as optional where it is not; and acknowledge feelings and concerns, even where information must still be shared.

Doing this work before a referral is made, rather than managing the fallout afterwards, is significantly less costly for everyone involved. This means that the time to invest is now, in training your DSLs. DSLs need to understand the data protection framework well enough to have confident, honest conversations with families at the point a referral is being made. They need to be able to explain the difference between transparency and consent, to communicate clearly what the school is legally required to do and why, and to do so in a way that is compassionate and builds rather than undermines trust. That training is something the DPO is well placed to lead.

The accuracy risk: A pitfall that ends up on the DPO's desk

Of the data protection principles, accuracy is the one that generates the most practical difficulty in an information sharing context. Organisations must take all reasonable steps to ensure that personal data held is not incorrect or misleading as to any matter of fact. When sharing matters of opinion, it must be made clear that it is an opinion rather than a matter of fact.

This distinction between fact and opinion is where the most common accuracy disputes arise. Consider a scenario that will be familiar to many DPOs: a pupil arrives at school with a bruise, along with other concerning factors. The DSL makes an early help referral under the duty. The early help team assesses the referral and takes no further action. Shortly afterwards, the parent contacts the school to say the bruise occurred during a football match and demands that the referral record be amended or removed.

A DPO faced with that situation needs to be clear about a number of things. The referral itself, if made on the basis of a genuine professional concern, is a record of a decision made at a particular point in time. It is not, and should not be recorded as, a statement of proven fact. The requirement that matters of opinion are clearly presented as opinion applies both at the point of sharing and in the records retained. The parent's right to rectification doesn't extend to deleting an accurate record of what was observed and what professional judgement led to. What may need to be added is the subsequent explanation offered by the parent, so that the record is complete and not misleading, rather than the original entry being removed.

Organisations should be able to demonstrate accountability for compliance with the duty and with data protection law, and should record the decision to share, or not to share, including the rationale. Good record-keeping at the point of sharing is the DPO's best defence when a rectification request or subject access request arrives later.

A practical checklist for DPOs

In summary, the key actions for DPOs in schools and academy trusts are:

1. Update your ROPA to accurately reflect information sharing under the duty with the lawful basis updated to Article 6(1)(c) legal obligation as set out in section 16LA of the Children Act 2004.
2. Review and revise your privacy notices to ensure they do not, even implicitly, suggest that parental consent is what determines whether a safeguarding referral is made.
3. Train your DSLs on the data protection framework underpinning the duty, so they feel confident to have honest, transparent conversations with families at the point a referral is made. Help them to understand clearly the difference between transparency and consent, and to communicate that distinction with confidence.
4. Work with your DSL to embed the guidance's practice principles into everyday safeguarding communications, so that families understand what is shared, why and with whom, before concerns arise rather than after.
5. Audit your record-keeping practices around sharing decisions, particularly the distinction between fact and opinion, so that accuracy disputes and rectification requests can be handled confidently and consistently.
6. Engage with your local safeguarding partnership's data sharing agreement review and ensure your DPIA process is fit to cover the new arrangements.

The information sharing duty doesn't 'trump' data protection. Data protection law provides a framework that enables the sharing of information in a fair, proportionate and lawful way. For DPOs in schools and trusts, the task is not to act as a gatekeeper, but to be a confident, well-informed guide who helps their organisation share the right information, in the right way, at the right time.

If you'd like support reviewing your privacy notices, records of processing, or data sharing arrangements in light of the new duty, please do get in touch with our specialist data protection in education team.