Information Sharing and Confidentiality
REGULATIONS AND STANDARDS
The Fostering Services (England) Regulations 2011
Regulation 22 - Records with respect to fostering services
Fostering Services: National Minimum Standards
STANDARD 26 - Records
RELEVANT GUIDANCE
Contents
1. Collecting and Processing Personal Data
The Agency will ensure that all personal data it collects in relation to foster carers and their families, children in placements and employees is stored securely, and that when it is shared with other agencies, this is done appropriately and in accordance with the law.
The Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and the Data (Use and Access) Act 2025 provide a legal framework to ensure that personal data which is collected and processed by organisations is done so fairly and lawfully, that it is accurate and relevant, stored securely (for no longer than necessary) and that, when it is shared, this is done appropriately and lawfully.
Personal Data - is the term used for information which could be used to identify a person (also sometimes called the 'data subject'). This includes for example, a person's name, address, or an identification/file number.
The UK GDPR, Data Protection Act 2018 and the Data (Use and Access) Act 2025 also emphasise the need for organisations to be transparent and accountable in relation to their use of data. Therefore, the Agency must ensure they have comprehensive and proportionate arrangements in place for collecting, storing, and sharing information. This should also include arrangements for informing employees, foster carers and children and young people about the information it collects and how this may be shared with other organisations (for example, in a privacy notice or children's guide).
The Manager must ensure that training on information sharing and confidentiality and the importance of accurate record keeping is provided for all new employees, foster carers and any volunteers as part of their induction. Refresher training should also be offered at appropriate intervals.
2. Sharing Information
When working with children and families, effective sharing of information is essential for the early identification of need, in order to complete robust assessments and to provide services which are tailored to individual need. Ensuring a child’s welfare and keeping them safe from harm will require staff and foster carers to record, analyse, understand the significance of and share information about:
- A child's health and development and exposure to possible harm
- Individuals (adults and other children / young people) who may pose a risk of harm to a child.
Agency staff and foster carers should be proactive and share information as early as possible where this will help to identify, assess and respond to risks or concerns about the safety and welfare of children. This includes when problems first emerge (for example going missing, persistent school absences, or receiving unexplained gifts or new possessions), information sharing is also essential for the identification of patterns of behaviour; for example, when a child has gone missing or is at risk of going missing, and when multiple children appear associated with the same context or locations of risk (this would include, for example, concerns around trafficking, Child Sexual Exploitation and Child Criminal Exploitation).
Often, it is only when information from a number of sources has been shared and is then put together that it becomes clear that a child has suffered, or is likely to suffer, significant harm.
Staff and foster carers should not assume that someone else will pass on information that they think may be critical to a child’s welfare and for keeping them safe. Anyone who has concerns about a child's welfare and considers that they may be a Child in Need or that the child has suffered or is likely to suffer significant harm, should share these concerns with the child's allocated social worker, practitioner, and/or the Police or Children's Social Care.
Staff and foster carers should be particularly alert to the importance of sharing information when a child moves from one local authority area into another, due to the risk that knowledge pertinent to keeping a child safe could be lost - for example, if a child moves to a new placement in another local authority area.
The Data Protection Act 2018, UK GDPR and the Data (Use and Access) Act 2025 do not prevent or limit the sharing of information for the purposes of keeping children safe. The UK GDPR provides a number of legal basis/reasons which set out when personal data can be shared between organisations. One of these bases is that the individual has consented to their information being shared. However, it is not necessary to seek consent to share information for the purposes of safeguarding and promoting the welfare of a child. This means that fears about sharing information must not be allowed to stand in the way of the need to promote the welfare and protect the safety of children. Where the information sharing duty applies, staff and foster carers must share relevant information.
Where there is a clear risk to the child’s welfare or of significant harm to a child, or serious harm to adults, staff and foster carers must share information.
From 30 September 2026, section 16LA of the Children Act 2004 (inserted by the Children's Wellbeing and Schools Act 2026) places a statutory duty on relevant organisations and practitioners in England to share information for the purposes of the safeguarding and promoting the welfare of children. This removes the need for a safeguarding threshold in this instance. Where a relevant person holds information they consider relevant to safeguarding or promoting a child's welfare and considers that sharing it may help another relevant person exercise their relevant functions, that information must be shared. A relevant person is defined as a person or organisation who has safeguarding duties or the duty to promote the welfare of children (such as local authorities, NHS bodies, police), a designated childcare or education agency or the providers of services arranged by safeguarding partners (which includes primary care providers such as GPs and dentists).
The duty sits alongside, and does not replace, the wider legal framework.
Whenever any information is shared, it should be proportionate, and a record should be kept of what has been shared, with whom and for what purpose and the reasoning behind it.
Key Points when Sharing Information
- Under the information sharing duty, you must share relevant information about a child without consent where it may help another organisation (see the three questions below). For adults, you may share without consent where there is a lawful basis, such as where their safety may be at risk. Base your judgment on the facts of the case and be clear about the basis for sharing or requesting information
- Seek advice from other practitioners (such as a manager of the Agency) if you are in any doubt about sharing the information concerned; this should be done without disclosing the identity of the individual where possible
- Information sharing should always be necessary, proportionate, relevant, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, that it is shared only with those people who need to have it, that it is accurate and up-to-date, that it is shared in a timely fashion, and that is shared securely
- Keep a record of your decision and the reasons for it - whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.
When deciding what to share under the information sharing duty, consideration should be given to these three questions:
Is the information relevant?
- Does the information you hold (about the child or someone connected to them) have a bearing on safeguarding or promoting the child's welfare? If information has been requested by external professionals, is there enough context to judge the relevance?
Could sharing the information help the recipient?
- Is the recipient covered by the information sharing duty? Could sharing reasonably help them to assess need or risk, make a decision, provide support or take action to safeguard and promote the welfare of the child, including where the child may pose a risk to others?
Would sharing be more detrimental to the child than not sharing?
- Would sharing the information be more detrimental to the child than not sharing it? This will apply only in extremely limited circumstances. Consider whether any steps could reduce the risk and record the decision and the reasons for it.
3. Breaches of Confidentiality
If personal data is shared without the consent of the data subject or when there was no legal basis for the sharing, the Agency will carry out an investigation into the circumstances and take appropriate actions as dictated by data protection legislation and the Information Commission.
Breaches of confidentiality will be taken seriously and may result in action being taken for example, a review of approval for foster carers or disciplinary action for staff.