Information sharing policy

It’s for all employees and volunteers. It also applies to third parties processing personal data on our behalf.

• Sharing information is often necessary for us to carry out our work and this policy outlines how to do so safely and within the law.
• When required to shared data you must have a valid contract or Data Processing Agreement in place, unless sharing personal information for the purposes of safeguarding.
• Safeguarding concerns exempt personal information from being subject to the Data Protection Act 2018.
• Where third party data processors are used, we must hold them to the same high standards of security that we hold ourselves to, and they must first complete a vendor security assessment.

• You should share personal data with the police and local authorities that, if not acted upon immediately, could be a risk to an individual’s safety.
• You must inform individuals if their personal information is being shared.
• If you are sharing information to perform a public task or as part of legitimate interest, you must inform the individual(s) and anonymise their data where appropriate.
• If you are sharing information for other reasons, you must acquire explicit consent from the individual or their guardian. You can use our Consent Form Builder to do so.
• If you wish to use a third party to process significant amounts of personal data (including sub-contractors or partners in children’s services) you must ensure the third party completes and passes our due diligence, and put a legal contract or agreement in place to cover the sharing. You must do this before any sharing takes place.
• You should only transfer personal data to third parties using secure transfer methods such as encrypted email or signed for post.
• If a third party makes a request for us to share information outside of a legal agreement, you should insist they make this request in writing, clearly highlighting the legal basis for the request.