Overarching Tier 1 Children Safeguarding Data Sharing Agreement (DSA)

3 Administration

The organisations below are signatories to this Tier 1 Data Sharing Agreement (see Appendix 5 for further details):

General:

Version control:

4 Scope

This Tier 1 Data Sharing Agreement applies to organisations operating within Cambridgeshire and Peterborough. It is a multi-agency agreement between Local Authorities, ICB & NHS Organisations, Police, Education, Probation, Prison Service and Voluntary Sector Organisations. A full list of signatory organisations can be found under section 3 Administration and in appendix 5. The Agreement covers the sharing of personal and special category data about children and young people for safeguarding reasons.

The Cambridgeshire and Peterborough Safeguarding Children Partnership is established in accordance with the Children Act 2004 (as amended by Children and Social Work Act 2017) and Chapter 2 Working Together to Safeguard Children 2023. The partnership provides the safeguarding arrangements under which the safeguarding partners and relevant agencies work together to coordinate their safeguarding services, identify and respond to the needs of children in the relevant area, commission and publish local child safeguarding practice reviews and provide scrutiny to ensure the effectiveness of the arrangements.

The responsibility for joined up working rests locally with three safeguarding partners who have a shared and equal duty to make arrangements to work together to safeguard children in a local area. These partners area:

1. a) The Local Authority (Chief Executive)
   b) Integrated Care Board (ICB) (Chief Executive)
   c) Police (Chief Officer)

The three safeguarding partners should agree ways to co-ordinate their safeguarding services, act as a strategic leadership group in supporting and engaging others; and implement local and national learning including from serious child safeguarding incidents.

This DSA is for use by professionals, staff and volunteers of organisations who have signed, and therefore agreed to the terms of this agreement and providers of services commissioned by the organisations who have signed this agreement. Safeguarding is everyone’s responsibility, not just safeguarding practitioners.

Where there needs to be a more specific agreement about sharing data, it will be necessary to complete a Tier 2 information sharing agreement. This agreement should not be seen as an alternative to a Tier 1 agreement, Tier 2 agreements must be completed for specific information sharing projects between the partner organisations but will be linked to this overarching agreement. The Tier 2 agreement should be developed in line with best practice and/or using the National Template and Guidance provided by the Department for Education which can be found here (Data Sharing Agreements – Important information for professionals (somerset.gov.uk)).

The Department for Education defines children’s safeguarding as follows within their ‘Working Together to Safeguard Children’ statutory guide to inter-agency working to safeguard and promote the welfare of children:

1. providing help and support to meet the needs of children as soon as problems emerge
2. protecting children from maltreatment, whether that is within or outside the home, including online
3. preventing impairment of children’s mental and physical health or development
4. ensuring that children grow up in circumstances consistent with the provision of safe and effective care
5. promoting the upbringing of children with their birth parents, or otherwise their family network through a kinship care arrangement, whenever possible and where this is in the best interests of the children
6. taking action to enable all children to have the best outcomes in line with the outcomes set out in the Children’s Social Care National Framework.

The Information Commissioner’s Office (ICO) recognises in their 10-step guide to sharing information to safeguard children that there is no single definition of safeguarding but highlights the inclusion of

1. a) preventing harm;
2. b) promoting the welfare of a child; and
3. c) identifying risk in order to prevent harm (especially helpful where the risk may not be obvious to a single person or organisation).

Safeguarding must therefore be seen as a protection of wellbeing (including physical, mental & emotional); a prevention of harm and reduction of risk through care and support requiring information sharing. This allows intervention in immediate situations demanding the safeguarding of children but also sharing for prevention and early intervention in less immediate or high-risk situations.

Information sharing with non-statutory agencies e.g. registered charities is within the scope of this Tier 1 DSA. There are a number of charitable organisations that offer support and services. Such organisations are not created under statute and therefore do not have statutory powers; nevertheless, they are often able to offer help and assistance in the form of counselling, advice, early help support, prevention and guidance as well as referring individuals to other organisations and charities within their network.

5 Purpose and benefits

The purpose of this Tier 1 Safeguarding DSA is to facilitate the lawful sharing, use and security of personal, special category data and criminal offence data in order to safeguard children who require safeguarding intervention and to facilitate the statutory functions of the Childrens Safeguarding Partnerships. This agreement will function as the foundation to embed strong, effective multi-agency arrangements that are responsive to local circumstances and engage the right people. Signatories to this agreement must be engaged to work in a collaborative way to provide targeted support as appropriate. This approach will provide flexibility to enable joint identification of, and response to, existing and emerging needs, and to agree priorities to improve outcomes. This agreement provides an overall framework for the secure sharing of information between the organisations (multi-agency/integrated working) that are parties to this agreement with the intention of:

• Protecting people’s health, wellbeing, and human rights, and enabling them to live free from harm, abuse and neglect (including self-neglect).
• Taking action to enable all children and their families to have the best outcomes.
• Identifying risk and emerging threats in order to prevent harm (prevention, early intervention).
• Raising public awareness so that communities as a whole, alongside professionals, play their part in preventing, identifying and responding to abuse and neglect and promoting the welfare of children.
• Preventing impairment of children’s mental and physical health or development.
• Ensuring that children are growing up in circumstances consistent with the provision of safe and effective care.
• Collaborating, sharing and co-owning the vision for how to achieve improved outcomes for vulnerable children.
• Challenging appropriately and holding one another to account effectively.
• Sharing information effectively to facilitate more accurate and timely decision making for children and families.
• Ensuring that shared learning is promoted and embedded in a way that local services for children and families can become more reflective and that changes to practice are implemented.
• Reducing the need for individuals to provide duplicate information when receiving an integrated service.
• Managing risks, performance, service planning and auditing.

6 Responsibilities / partner commitments

By becoming a partner to this sharing agreement all organisations are making the following commitments. It is understood that signatories to this agreement are committing their whole organisation to entirely support the principles and carry out their responsibilities to the full.

The qualifying standard for organisations to achieve to sign up to this sharing agreement is achievement of ‘standards met’ to the current version of the Data Security & Protection Toolkit (Data Security and Protection Toolkit (dsptoolkit.nhs.uk)) or equivalent standard depending on the type of organisation.

If ‘standards met’ has not been achieved (organisation failed, not required to complete the DSPT, DSPT expired) organisations will be asked to confirm their plans (including the completion of the DSPT voluntarily) and share the relevant details. The statutory partners will consider the position of the organisation and make recommendations regarding the signing of the agreement.

7 Lawfulness

Partners agree that in order to share personal data, there needs to be a relevant legal gateway. It is important to note that the existence of this Tier 1 Safeguarding Data Sharing Agreement does not provide partners with a legal gateway or secure an automatic right or obligation to share information with or from another partner. This may come from statue, common law, or legal precedent. Statutory powers (also referred to as legal gateways) will differ between the signatory organisations and cannot be prescribed in this Agreement. A list of commonly used legal gateways / applicable legislation for safeguarding sharing can be found in Appendix 3.

Principle legislation governing the protection and use of personal information is:

1. UK General Data Protection Regulation (GDPR)
2. Data Protection Act (DPA) 2018
3. Human Rights Act 1998 (article 8)
4. The Common Law Duty of Confidentiality

Each signatory must be able to identify their lawful basis to share personal data which should be recorded within a Tier 2 Data Sharing Agreement. The lawful basis under the UK GDPR and Data Protection Act 2018 is however likely to be the following:

Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.

Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

Article 9(2)(g) – processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Article 10 Criminal offence data processing meeting a specific condition in Schedule 1 Data Protection Act 2018.

The Police’s underlying power to share personal data is derived from (i) Common Law Policing Purposes which may be summarised as: protecting life and property, preserving order, preventing the commission of offences, and bringing offenders to justice and/or (ii) any duty or responsibility arising from statute or other rule of law including court order and royal prerogative.

The signatories of this agreement understand that ‘Consent is one lawful basis, but it is not required for sharing information in a safeguarding context. In fact, in most safeguarding scenarios you will be able to find a more appropriate lawful basis.’ (Source ICO). The UK GDPR provides several bases for sharing personal information. Partners will however be transparent with individuals whose data is being processed if it does not increase the risk of harm. The difference between consent to treatment/service opt-in and consent to share information under Data Protection laws must be understood by all partners to this agreement. If consent to share information is considered to be required, this must be escalated to the relevant partner organisation’s DPO for review.

8 Guidance

Partners will rely on the following guidance to adhere to principles defined in this agreement.

National Guidance:

• Working together to safeguard children 2023 (Department for Education)
• Information Sharing Advice for practitioners providing safeguarding services for children, young people, parents and carers (Department for Education)
• 10 step guide to sharing information to safeguard children (Information Commissioner’s Office)
• MAPPA Guidance (Ministry of Justice, National Offender Management Service, HM Prison Service)
• The Caldicott Principles (National Data Guardian)
• Serious Violence Duty (Home Office)
• Management of Police Information (MoPI) statutory Code of Practice College of Policing
• MARAC Guidance Department for Health

Local Guidance:

• Multi Agency Safeguarding Arrangements [currently still under development, add link once available]
• Information Sharing Cambridgeshire and Peterborough Safeguarding Partnership Board

9 Security Standards

Each partner will be responsible for ensuring data is subject to sufficient security.

All partners signed up to this agreement must ensure appropriate organisational policies and procedures are in place to cover the security of personal information under this agreement.

All reasonable steps should be taken to ensure that confidentiality of data is maintained, the integrity of data is preserved and that data remains available where needed.

Controllers must also consider determining how they will test/audit the effectiveness of information security controls as part of a Data Protection Impact Assessment.

Sharing arrangements involving shared systems/assets will require joint decisions on security controls, therefore responsibility may be shared (pertinent to joint controller arrangements). This may include (but is not limited to) decisions on:

• A satisfactory level of compliance with industry cyber/information security standards (e.g. Cyber Essentials)
• A role-based access model
• Patching schedules
• Remote access solutions
• Third party security assurances and contractual arrangements (which may permit certain autonomy to maintain security)
• Recovery point/time objectives

A system level security policy should be developed jointly for such assets to document the agreed security controls/assurances for the sharing partners and demonstrate controller responsibility.

Appropriate contractual, data processing and confidentiality agreements must be in place to underpin the processing of personal information by a third party / processor.

10 Proportionality and necessity

The data relevant under this Tier 1 Data Sharing Agreement can include personal data, special category data and criminal offence data shared for the reasons of safeguarding.

Partners agree that only information that is relevant to the purposes should be shared with those partners who need it (need to know basis). Assessing proportionality and necessity for any sharing initiative under this agreement is paramount and should be documented to assure compliance with current UK data protection legislation. In circumstances where data is to be shared for safeguarding purposes both the benefits and the risks must be balanced against each other to assure the right level of proportionality and necessity. Organisations signed up to this Tier 1 Data Sharing Agreement must therefore include Caldicott Guardians (for Health), Service Leads or other equivalent individuals as they must be core to such decision-making. It is recommended under this agreement that organisations take a default ‘starting position’ of considering what data/information is reasonably, foreseeably needed. Data minimisation and proportionality will be maintained by only asking for data that is needed to fulfil a specified purpose.

Partners must consider any harm or detriment that may come from sharing information, and make sure this does not outweigh what is trying to be achieved (least intrusive amount of personal information to be shared appropriate to the risk presented). This is particularly important for sensitive information. Partners will consider who could be affected by any disclosures contemplating that sharing information about one individual may also have an effect on the privacy rights of others. Information must be of the right quality to ensure that it can be understood and relied upon.

Organisations signed up to this agreement will consider the level of identification required for each sharing initiative.

11 Retention

Records will be retained and disposed of in accordance with data protection legislation and national and local/organisational guidelines. Each organisation which has received information referred to in this agreement has to follow their own Retention and Disposal Policy which should state how long they will keep different types of information. Additionally, organisations should consider the business need beyond any national/industry code or guidance which could justify a shorter or longer retention period. Retention periods should be agreed with sharing partners, at the early stages of data sharing, in a Tier 2 Data Sharing Agreement as relevant (documented justification). Especially sharing arrangements involving shared systems/assets require joint decisions on retention and/or system configuration as they are more complex.

Health and Social Care partners will consider the NHS England Records Management Code of Practice to inform decision making. The Constabulary (and other Police Forces) must consider and also comply with the statutory College of Policing Management of Police Information (MoPI) Code of Practice and Guidelines, also known as the Authorised Professional Practice (APP) for Police Information. Other partners will consult the relevant industry guidelines.

National inquiries must be considered when assessing records for destruction.

Any records which no longer need to be retained in accordance with the partners’ own policies and procedures should be destroyed under secure conditions.

12 Individuals’ Rights

The partners agree that in simple sharing arrangements each Controller will handle subject rights requests in accordance with their own established processes and policies. In multi-stakeholder sharing arrangements where shared information assets/systems are used, responsibilities for the handling of individuals’ rights requests by the sharing partners must be clearly set out in the relevant Tier 2 Data Sharing Agreement. Requests relating to information shared for safeguarding purposes are likely to require careful consideration and may require assistance from partners as the provider of the information may be aware of a wider context to make a fully informed decision. Therefore, sharing partners agree to set out clear arrangements in a Tier 2 Data Sharing Agreement or Policy for the handling of individuals’ rights and provide reasonable assistance to sharing partners as required.

The right to be informed – Partners must ensure that individuals are informed about the collection and use of their personal data and are provided with the privacy information required as per current data protection law. See the following section ‘Transparency’ for further detail.

The right of access – Sharing partners will set out clear responsibilities, including (but not limited to); whether there will be a central process to manage and co-ordinate requests, what the process shall be if a request is received by them but is relevant to another organisation, how partners’ involvement affects what they should disclose and the process for determining lawful reasons to withhold data from disclosure (i.e. if they are viewing data in a shared asset but are not controller nor a joint controller of the data, or if they are a joint controller).

The right to object and the right to restrict – Sharing partners will set out clear responsibilities, including (but not limited to); whether there will be a central process to manage and co-ordinate objections and restriction requests, what the process shall be if an objection or restriction request is received by them but is relevant to another organisation and the process for determining whether to uphold the objection or restriction request (although unlikely due to the nature of processing).

The right to rectification – Sharing partners will agree a process of how to respond to requests for rectification (i.e. if received by them but it is relevant to another organisation). The process will be dependent upon the sharing arrangement; this may require action from multiple partners (especially when a request for rectification of a professional opinion is received) or by a single partner that has provided the data into a shared asset and may require partners to assist each other to determine whether data should be rectified.

The right to erasure – Sharing partners will agree a process of how to respond to requests for erasure (i.e. if received by them but it is relevant to another organisation). It is unlikely to uphold a request for erasure when processing for Safeguarding reasons.

Automated decision-making and profiling – If the sharing arrangement is to involve automated decision-making or profiling then the sharing partners will agree how individuals affected will be informed of this (unless an exemption applies) and how requests for a member of staff to review any such activity will be handled. As it stands, data used for safeguarding purposes is unlikely to be classed as ‘automated decision making’ or ‘profiling’ without human intervention prior to decisions being made that affect individuals.

The right to data portability – If the sharing arrangement is to involve the processing of data based on the explicit consent of the data subject or a contract with the data subject (which are both highly unlikely for the purposes of safeguarding), or data will be carried out by automated means, then the sharing partners shall ensure that it is possible for data to be provided to the data subject in a structured, commonly used and machine-readable format and/or have this data transmitted to another controller. The lawful basis of processing data for safeguarding purposes is not likely to be explicit consent. Therefore, it is unlikely that the right to data portability applies.

Any Information Rights request directed at the Safeguarding Partnership should be forwarded to the Cambridgeshire County Council (if relevant to Cambridgeshire) or Peterborough City Council (if it relates to Peterborough) Data Protection Officer (FOI@cambridgeshire.gov.uk or FOI@Peterborough.gov.uk) or to coordinate the appropriate response. When a partner agency requires cooperation from the Safeguarding Partnership to respond to a Subject Access Request they should contact the relevant Business Support Team Manager to ensure appropriate liaison with the Council’s Data Protection Officer.

13 Transparency

Each organisation must be clear, open and transparent with data subjects about the collection and use of their personal information, paying particular attention to the ‘right to be informed’. The sharing partners (controllers) each have a responsibility to take reasonable steps to ensure that individuals (to whom data they are processing pertains) are informed of the uses of their data. The sharing partners will therefore agree an approach to informing individuals about the sharing of data for safeguarding purposes. This may, for example, take the form of each partner updating their own privacy information (i.e., a website privacy notice) or the partners may agree to reference a single privacy notice from their own privacy information, which is then maintained by one or several organisations (e.g., joint controllers). The privacy information must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language, tailored to children if required.

Best practice in respect of transparency is to take a layered approach by utilising various methods to communicate information about how individuals’ data is being used, i.e., website privacy notice, leaflets, posters, letters, conversations, etc., However, given the nature of processing for safeguarding purposes it may not always be appropriate. The sharing partners must consider exemptions (e.g., law enforcement purposes under Part 3 of the DPA 2018, or serious harm to the physical or mental health of any individual).

14 Staff development

Each sharing partner must ensure that its staff are sufficiently trained to handle personal data appropriately as part of their controller responsibilities under UK data protection law (the UK GDPR principle of ‘accountability’ and specifically principle 5(f) (integrity and confidentiality) as an appropriate organisational measure). This can include training on confidentiality, data protection, record keeping, records management, system training, as well as more specific training on handling individuals’ rights requests for those staff typically involved in these, etc. Sharing partners should therefore consider whether staff affected by a new sharing arrangement will require additional training (in addition, controllers should continually assess the training needs of their workforce, which is often done by maintaining/appraising a ‘Training Need Analysis’ on a routine basis).

All staff must have access to the policies of their own organisation, this agreement and any materials jointly developed. For the purposes of this agreement the supporting processes will be that all staff authorised to access information will be trained in the basic requirements of the Data Protection legislation and have an awareness of the implications associated with shared information. They will also understand the risks associated with inappropriate disclosures and the impact that this has on safeguarding and the necessity to undertake thorough checks. Staff contracts must therefore contain appropriate confidentiality clauses detailing the possible consequences of unauthorised or inappropriate disclosure of personal information. Each organisation must have in place disciplinary procedures to be invoked if a member of staff is found to have breached the confidentiality of an individual. Consideration should be given to the category and nature of information to which staff have access and whether their role includes any specific requirements to access personal information.

The process of supervision is generally confidential between the supervisor and supervisee(s). The ground rules in relation to confidentiality will be made explicit, such as ownership of supervision records, retention of information. There may be occasions when it is necessary to share information with other practitioners/ managers/ external agencies/professional bodies in the best interests of the child at risk in line with organisational and multi-organisational information sharing agreements. Poor or dangerous practice will be addressed in line with partner organisation policy and procedures.

15 Incident Management and Complaints

Data security and protection incidents must be treated with priority and urgency; swift action should be taken to contain incidents and prevent both the number of individuals that may be affected and increased severity for those already affected. As such, sharing partners must inform the responsible controller as soon as possible (where they become aware of an incident that they are not responsible for or are only partially responsible for). Sharing partners must also determine whether other sharing partners (beyond those responsible) should be informed as concerns may have been, or be, raised to them that are linked to the incident, which they may otherwise not know.

Given the nature of the data involved in processing for safeguarding purposes, care and consideration should be given to who needs to be informed of an incident (in terms of both sharing partners, as well as the individuals affected and/or third parties).

Where an incident is isolated and deemed to only affect one sharing partner than the incident may be handled solely by that sharing partner according to their own incident management policy and processes. Where multiple sharing partners are affected, they must be prepared to establish a joint incident response plan. Clear responsibilities should be set out for any joint controller arrangements.

Complaint handling should follow a similar path; however, they are unlikely to require such priority/urgency unless they are intrinsically linked to an incident.

All partner organisations must put in place processes that allow concerns about non-compliance with this agreement to be reported to the designated person.

16 Common sharing initiatives / area of work

The below sharing initiatives are covered by this agreement and give detail of how data is being used to safeguard children and their families.

It should be noted that the above list is not exhaustive but any data sharing for Safeguarding Children purposes will still fall under this agreement.

There is a duty on Local Authorities under the Children and Families Act 2014 and the Care Act 2014 to assure a safe transition from Children’s to Adult Services. Where there are ongoing safeguarding concerns or needs for a young person and it is anticipated that on reaching 18 years of age, they are likely to require adult safeguarding support, the relevant arrangements should be discussed as part of the transition and the appropriate information must be shared.

17 Dissemination, monitoring and review of the agreement

This protocol will be shared with all signatories, processors and relevant parties for the purpose of upholding the principles of this agreement.

It is intended that this overarching Tier 1 Data Sharing Agreement contains high level principles and partner commitments only. It will therefore be reviewed every annually to establish if the sharing remains necessary, still operates as intended and, has or is, achieving the intended benefits, unless legislative changes or other significant changes require immediate action. The monitoring and review of this protocol will be undertaken by members of the Executive Safeguarding Partnership Board.

Subject to there being no significant changes, the agreement may be extended by a further year without seeking further approval or new signatures. However, any significant changes will require the full approval process.

In the event that this Tier 1 Agreement is not renewed or is otherwise withdrawn, it is incumbent on the parties to amend their records accordingly and to communicate the status of the agreement within their respective organisations to interested parties and the wider public as necessary. The obligations of confidentiality imposed on the Parties by this Agreement shall continue in full force and effect after the expiry or termination of this Agreement.

18 Signatories

If this Data Sharing Agreement is published to a system that manages signatures/agreement, then this section can be removed.

Each organisation should identify who is the most appropriate post holder within their agency to sign the DSA having taken account of their organisational policy and the fact that the signatory must have delegated responsibility to commit their agency/organisation to the agreement. Additionally, each agency will be asked to identify the post which is responsible on a day-to-day basis for monitoring compliance with this DSA.

By signing this DSA, all signatories acknowledge and accept the requirements placed upon them and others within their organisations by the DSA and their responsibilities under data protection legislation. A decision needs to be made if the signatory is a list of organisations all signing one document in turn, or if a single organisational signature is collected per copy of the DSA, with a central point of collection and maintained list of signatories.

Appendix 1 – Glossary of terms

Appendix 2 – Information sharing checklist

By sharing information, we work better together, and this Tier 1 Children Safeguarding Data Sharing Agreement encourages the appropriate sharing of personal information between the relevant agencies. If you cannot identify an individual from the information you are planning to share, then you are free to share. However, if the information identifies an individual, please use this checklist to help you determine that it is safe to share information. Here is a simple flow chart of what you will need to do to go from having concerns about sharing data to sharing data legally and securely with confidence.

Routine Information sharing checklist (e.g. monthly, routine data sharing of specific indicators)

Why is the information needed?

What is the purpose for sharing the relevant information, think about the purpose for individuals, your organisation and the wider public.

What information is needed?

Be specific and descriptive, consider how often it is required.

What organisation can provide the information?

Have you explored if the information is available already, maybe in other parts of your organisation. Have you spoken to a counterpart in the potential sharing organisation who can advise you on what information is available and how often.

Have you completed a Data Protection Impact Assessment (DPIA)?

Be aware that a DPIA is likely to be a legal requirement. Complete it before you start processing any data.

How will it be transferred?

Consider your options and assess the risk of those. Transfers must be safe and secure, consult with your technical teams for more complex digital solutions (e.g., data transfer system to system or via Secure File Transfer Protocol [SFTP]).

Where will it be held?

Consider your options and assess the risk of those. Any information must be held safe and secure, consult with your technical teams for more complex digital solutions.

Are you sure the information is accurate and not misleading?

Take all reasonable steps to ensure the personal data you hold is not incorrect or misleading. If you discover that personal data is incorrect or misleading, you must take steps to correct or erase it as soon as possible. Carefully consider any challenges to the accuracy of personal data.

How will you process it?

Define what solutions are available to process the information (e.g., data warehouse, modelling, risk scoring, manual usage to inform cases), work closely with the relevant teams (e.g., analytics, IT, ethics).

How long will you keep it?

Follow your internal retention policy and establish how long you need the information. Include any potential outcome products and long-term requirements to hold the data.

How will you delete the data?

Follow your internal records retention or data destruction policy to assure safe destruction of the information you hold. Consider the method depending on your storage solution to allow for safety of destruction.

Ad-hoc Information sharing checklist (e.g. sharing ad-hoc during corridor conversation)

Why is the information needed?

What is the purpose for sharing the relevant information, think about the purpose for individuals, your organisation and the wider public.

What information is needed?

Be specific and descriptive, consider what information is necessary and relevant.

Is it fair to share in this way?

Consider less intrusive ways of fulfilling your purpose or reach your objectives and consider what individuals are expecting to happen to their data.

What are the benefits and what are the risks?

Balance the benefits for an individual and/or the public against the risks of harm it could cause.

Where does the information originate from, does the source organisation need to be consulted?

Consider who is best placed to assess disclosure decisions around the risk of causing harm (e.g. interference with a police investigation, disclosure of details not knows to the recipient (adopted child).

What needs to be done to transfer the information securely?

What technical and organisational measures are appropriate to ensure the security of the data.

Am I being transparent about information sharing?

Consider what you have to tell people about sharing their data and how you will communicate that information in a way that is concise, transparent, easily accessible and uses clear and plain language.

Check your organisational policies and procedures

What policies and processes around sharing are in place and what guidance must be considered.

Ask for help to make disclosure decisions

Consult colleagues, managers and Caldicott Guardians if you are unsure about sharing information.

Document your decision

Document your decision as appropriate.

Appendix 3 – Applicable Legislation

Appendix 4 – Partners to this agreement