Consent To Share Information
The starting point must always be to seek the informed consent of the adult before sharing information with other services or organisations. Consent should be obtained wherever possible, unless there are clear and lawful reasons not to do so: such as where the individual lacks mental capacity, or where seeking consent would place them or others at risk of serious harm. However, information can still be shared without consent if it is not possible to obtain it, or if consent is declined, provided there is a legal basis to do so. This may include situations where there is a risk of abuse or neglect, or where it is necessary to protect the vital interests of the individual or others.
Organisations involved with adults with care and support need process data mostly under the public task and legal obligation lawful bases as the duty of confidentiality is not absolute and, in most cases, where it is appropriate to share information, obtaining consent wouldn’t matter as data will be shared regardless if safeguarding is triggered.
However, the factors listed below should be considered before a decision is made to share information. It is a balancing exercise: whether the requirement for information for confidentiality should be overridden by the reason that it is considered necessary to disclose. In situations of doubt, specialist or legal advice should be sought.
All information is shared in confidence and the rules of confidentiality always apply.
Partner organisations can share information even when consent is refused. This is because their lawful bases in those instances include the following:
- contract – necessary for a contract partner organisations have with the individual, or because they have asked you to take specific steps before entering into a contract
- legal obligation – necessary for the partner organisation to comply with the law (not including contractual obligations)
- vital interests – necessary to protect someone’s Iife
- public task – necessary for the partner organisation to perform a task in the public interest or for their official functions, and the task or function has a clear basis in law
- Legitimate interests – necessary for the partner organisations legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests (this cannot apply if you are a public authority processing data to perform your official tasks)
The Data Use and Access Act (DUAA) in June 2025 introduced a new, seventh lawful basis under UK GDPR, that of Recognised Legitimate Interests - where processing is necessary for disclosure to a person carrying out a public interest task, public security, crime detection, investigation and prevention, protection of a data subject’s vital interests, and safeguarding vulnerable individuals. As this basis has only just been introduced, agencies should look to their internal or local protocols/agreements when considering use of this basis.
All partner organisations as data controllers are legally obligated to always record and document their lawful bases for processing data, including when sharing for safeguarding reasons per the remit of this Agreement.
Partner organisations where they rely on any of the stated lawful bases stated above (excluding consent) are also legally mandated to inform all data subjects of the data processing of their data.
Emergency and/or life-threatening situations may warrant the sharing of relevant information immediately with the relevant emergency services. This should be covered in partners’ privacy notice information (or specific service information sheet).
All partner organisations must ensure that decisions regarding the sharing of information are clearly recorded regardless of whether consent has been obtained. This includes documenting the rationale behind the decision to share or not share, the legal basis under which it was made, and how it aligns with relevant legislation.