From 30 September 2026, there is a new legal duty to share information about children. This applies to certain organisations and professionals working with children. If you have information that could help keep a child safe or support their wellbeing, you may have a legal duty to share it with the appropriate organisation or professional.

Download our FREE statutory sharing information quick overview

Our experts have produced a FREE statutory sharing information quick overview PDF about the changes from 30 September 2026

Download the free quick overview guide

This is not a routine wording update - it is a change from the document being advisory (good practice) to a new legal duty to share information for early years providers (see chapter 1, point 25 which includes childcare settings in the new duty). However, note that the duty only applies to designated organisations - not every organisation you might share information with is automatically covered.

The key change is the new Information Sharing Duty in section 16LA of the Children Act 2004, introduced by the Children's Wellbeing and Schools Act 2026.

For the purposes of this guidance 'early years provider' includes nurseries, childminders and other early years settings where applicable.

The practical shift for early years providers moves from asking, 'Can I lawfully share this information?' to recognising, 'Is this information relevant to safeguarding and / or promoting this child's welfare and could sharing it help another relevant organisation?' If the answer to this question is, 'yes', where the statutory conditions are met, the duty requires the relevant person to disclose the information, subject to the statutory exception where disclosure would be more detrimental to the child than not disclosing.

Who is the relevant person?

Who is covered by the duty? The duty applies to 'relevant persons' specified by section 16LA(4) of the Children Act 2004. This includes specified public bodies, designated childcare or education agencies and certain persons providing safeguarding or welfare services on their behalf. Being an organisation that works with children does not, by itself, mean that an organisation is automatically subject to the statutory duty.

Where the proposed recipient is not a relevant person for the purposes of section 16LA, the statutory duty does not itself require disclosure. Early years providers should consider the other applicable legal powers, duties and data protection requirements and request advice from the safeguarding partners or the Information Commissioners Office (data protection) where necessary.

Here is a quick overview of what has changed from 2024 - 2026

The legal status:

• 2024 - non-statutory advice.
• 2026 - statutory guidance - you need a good reason not to follow statutory guidance.

The core legal framework:

• 2024 - data protection and existing safeguarding powers and duties.
• 2026 - new section 16LA statutory duty to share information.

Threshold for sharing:

• 2024 - consider whether there is a lawful basis and safeguarding justification to share.
• 2026 - the duty is not dependent on a particular child-protection threshold, such as the section 47 threshold. The statutory conditions for the information-sharing duty must nevertheless be met.

Early help / emerging need:

• 2024 - information could be shared where lawful and appropriate.
• 2026 - information may need to be shared where it is relevant to safeguarding or promoting a child's welfare and the statutory conditions are met.

Consent:

• 2024 - consent was not generally a prerequisite to safeguarding information sharing under the previous framework, although early years providers and local authorities often treated it as such.
• 2026 - consent is not normally required for information sharing under the duty.

Confidential information:

• 2024 - complex common-law confidentiality and public-interest confusion.
• 2026 - section 16LA provides a legal requirement that removes barriers where criteria are met.

Requests for information:

• 2024 - existing powers and frameworks.
• 2026 - the duty also applies when other relevant organisations request information. However, a request does not mean you have to hand over everything you hold about the child.

Detriment to the child:

• 2024 - general proportionality / safeguarding considerations.
• 2026 - express statutory exception where sharing would be more detrimental to the child than not sharing.

Local arrangements:

• 2024 - information sharing protocols encouraged.
• 2026 - local data sharing arrangements need to be reviewed to reflect the new duty.

Data sharing agreements:

• 2024 - existing good practice.
• 2026 - DfE now provides Tier 1 and Tier 2 templates for local authorities.

Cross boundary sharing:

• 2024 - good practice.
• 2026 - explicit expectation to share relevant information when children move between areas.

Routine sharing:

• 2024 - possible if lawful.
• 2026 - expressly supports regular information flows - for example, attendance and absence data where relevant alongside welfare and safeguarding information.

The biggest change: sharing is now a statutory duty.

The updated statutory guidance is based on section 16LA of the Children Act 2004 and it applies where a relevant organisation holds information about a child, or another person connected with the child and considers the information relevant to safeguarding or promoting the child's welfare. The organisation must disclose the information to another relevant organisation where it considers that disclosure might or will facilitate that organisation's safeguarding and / or welfare functions.

This is important because the legislation moves away from the idea that early years providers should wait for a high safeguarding threshold before information can be shared. The updated statutory guidance explicitly states there is no requirement for a particular statutory threshold, such as the section 47 threshold for child protection enquiries, before information can be shared. Instead, the statutory guidance expressly references early help, prevention and unmet need. For example, information doesn't necessarily have to indicate significant harm before it can trigger information sharing.

The statutory guidance states that the duty applies to information that could help another organisation assess risk or need, make a decision, provide support as required, take safeguarding action, promote the child's welfare and respond where the child might reasonably pose a risk to other children.

Note that this is reflected in the EYFS 2026 which refers to 'harm' instead of 'serious harm' (EYFS 2025) as a threshold for reporting concerns to Ofsted.

More than child protection

The updated statutory guidance is framed around 'safeguarding and promoting welfare' rather than simply protecting children from abuse. The definition includes, for example:

• Identifying need.
• Preventing harm or escalation.
• Promoting welfare.
• Protecting children from harm.
• Circumstances where a child might pose a risk to other children.

It can include contextual, partial, historical and pattern-based information - for example, a collection of relatively minor pieces of information held by different agencies could become significant when brought together. The statutory guidance emphasises that safeguarding partners should be able to build a fuller picture of the child's circumstances, rather than each agency assessing its own isolated piece of information.

Consent is clearly separated from information sharing

The updated statutory guidance states that consent is not required to share information under the statutory duty and makes a distinction between:

• Consent as a lawful basis under data protection law.
• Consent to receive a service.
• Consent to medical treatment.
• Consent under the common-law duty of confidentiality.
• Being transparent with the child or family.

The statutory guidance states that consent is only one possible lawful basis under data protection law and that, in safeguarding and / or welfare circumstances, legal obligation, public task or recognised legitimate interests will often be more appropriate. It also states that consent is unlikely to be appropriate where:

• There is an imbalance of power.
• Consent might subsequently be withdrawn.
• Maltreatment, exploitation, abuse and / or neglect is suspected.
• Seeking consent could undermine safeguarding.
• Seeking consent could increase the risk of harm.

This does not mean early years providers stop involving parents in decisions that affect them or their child - the updated statutory guidance continues to promote transparency and engagement with children and families where it is safe and practicable. However, early years providers shouldn't give a parent the impression that permission is needed before information is shared where they have already decided that information must be shared. Instead, the statutory guidance recommends explaining what is being shared, with whom and why, while recognising that sharing might go ahead without agreement or permission.

Confidentiality has changed

This could be significant for health practitioners, GPs, mental health services and other professionals holding confidential information, including early years providers. Previously, professionals might face a question around whether confidential information could be disclosed without consent - including whether disclosure is justified and under which legal basis.

The updated statutory guidance states that where the statutory criteria under section 16LA are met, the statutory duty itself provides the legal requirement to share. This means that the duty of confidentiality does not prevent sharing and confidential information can be shared without consent, subject to the statutory criteria and data protection requirements and where the statutory conditions for section 16LA are met.

Data protection is still relevant

The new duty doesn't override UK GDPR, or the Data Protection Act legislation and organisations must still comply with data protection law set out on the Information Commissioner's Office website. For example, early years providers still need to consider:

• Lawful basis.
• Special category data.
• Criminal offence data.
• Data minimisation.
• Accuracy.
• Security.
• Accountability.
• Transparency.
• Appropriate records.

However, section 16LA itself is identified as a legal obligation under Article 6(1)(c), where its criteria are met. This means that, while data protection legislation remains a framework for sharing, it is no longer something that should be treated as a general reason not to share.

Note that the EYFS 2026 has updated wording around safeguarding documentation to include 'accurate' as a record keeping requirement.

Note the 'detriment' clause

The new legislation states the duty doesn't apply if the early years provider considers that disclosure would be more detrimental to the child than not disclosing it - however, the statutory guidance states this should be extremely limited and rare. It gives examples such as sharing information that could reveal the location of a child who is being hidden from an alleged perpetrator of domestic abuse.

In that situation, the early years provider might share the relevant safeguarding information but withhold the location because disclosure could directly expose the child to serious harm. This is not a general sharing exception - it is very specific and early years providers will need to take advice if they are unsure whether 'potential detriment to the child' is relevant. Decisions relating to detriment should be recorded and reviewed.

Proactive information sharing

The legislation states that the duty applies where a relevant organisation receives a request for information from another relevant organisation. This addresses previous concerns around handing information to, for example, the child's next setting. Some local authorities already have processes in place to encourage information sharing and providing information to another safeguarding organisation - the statutory guidance now makes it a requirement to share and to respond to requests to share.

The statutory guidance encourages requestors to provide enough context for the recipient to understand why the information is relevant and how it might facilitate safeguarding and / or welfare functions. However, note that if a request is received and the recipient is unsure about what, when or how to share, they should identify what is appropriate to share first and if unsure, contact the safeguarding partners to ask for advice.

Before sharing - a quick checklist

• Am I acting within the scope of section 16LA - do I need to take further advice?
• What information do I hold?
• Does it relate to a child or individual connected with the child?
• Is the information I am sharing relevant to safeguarding or promoting the child's welfare?
• Is the proposed recipient a 'relevant person' under section 16LA?
• Could disclosure support the recipient's safeguarding and / or welfare functions?
• Would sharing be more detrimental to the child than not disclosing?
• What information is relevant and proportionate to disclose?
• Is the information I am sharing accurate and up to date?
• How transparent can I be while protecting the child or family's safety?
• What data protection requirements apply?
• How will the information be shared securely?
• Have I recorded my decision including reasons for sharing / not sharing?
• Do I need to speak to the safeguarding partners or other agency first for further safeguarding advice?

Information about adults connected to children

The new duty isn't limited to information about the child. It can also cover information about another individual connected to the child, where that information is relevant to safeguarding and / or promoting the child's welfare. The statutory guidance gives examples including:

• Parental mental health.
• Parental alcohol use.
• Domestic abuse.
• Offending.
• Imprisonment.
• Exploitation.
• Adults who pose risks to children.

This is because information held about an adult can potentially fall within the duty because of its relevance to a child's circumstances.

Early intervention

The updated statutory guidance places an emphasis on early identification. It states the duty applies to children with established needs and children whose needs are being identified for the first time. This means the information-sharing framework is intended to support the whole continuum - emerging need, early help, escalating need, safeguarding and child protection, rather than information sharing only becoming relevant at the point of serious harm.

The statutory guidance specifically discusses information flows across Family Help, integrated front doors and Multi-Agency Child Protection Teams.

Local safeguarding partnerships need to revisit their arrangements

The statutory guidance states safeguarding partnerships will need to revisit their data sharing agreements and revise them to take account of the new duty. DfE has supplied a Tier 1 multi-agency data sharing agreement template and a Tier 2 template. These are intended as starting points for local adaptation. The statutory guidance also states partnerships should consider an overarching Data Protection Impact Assessment (DPIA) before agreeing their data sharing arrangements.

This should mean that training will be available for early years providers when local authorities have made their decisions.

Systematic information flows

The statutory guidance isn't just talking about individual referrals - it also directly supports strategic and routine sharing where safeguarding partners have agreed that information is necessary to fulfil their functions. The example given in the statutory guidance relates to school attendance and absence information, including patterns suggesting a risk of a child becoming NEET (not in education, employment or training), where safeguarding partners have identified that information as relevant to identifying need, risk or emerging harm. This means that there is a move towards sharing when an incident occurs alongside building agreed systems to identify emerging problems earlier.

In the safeguarding context, NEET status can be an indicator of emerging need or vulnerability. For example, information about attendance, attainment, exclusion, disengagement or other circumstances might help agencies identify that a young person is at risk of becoming NEET and intervene earlier.

Cross-boundary sharing

The statutory guidance specifically states relevant organisations are required to share concerns across organisational boundaries within England where a child is relocating and the information is likely to help the receiving organisation assess need, make decisions, provide support or safeguard the child.

What does this mean for you?

For an early years provider, the change is important, but it does not mean you suddenly have to share every piece of information about children with other agencies. The key point is that early years providers are within the scope of the new information-sharing arrangements and the duty is intended to make it easier to share relevant information early, before concerns necessarily reach a child-protection threshold.

In practice, imagine you have a child where you are becoming concerned about a combination of things including:

• Frequent unexplained absences / poor or inconsistent attendance.
• A noticeable change in behaviour.
• Concerns about home circumstances.
• Injuries or explanations that don't quite fit.
• A parent struggling with circumstances that appear to affect the child.
• Developmental or emotional concerns.
• Another professional has raised a concern about the family.

Previously, you might have wondered whether you have consent to share or if it's serious enough to contact social care or whether you need parent permission to raise it or if you might be breaching data protection legislation.

The new approach is much more about whether the information is relevant to safeguarding the child's welfare - and whether sharing it could help another organisation provide support for or safeguard the child.

If the answer is 'yes', the updated statutory duty is designed to make sharing the expected course of action, subject to the safeguards in the legislation and guidance. The duty is specifically intended to support earlier intervention, including emerging needs and prevention.

For an early years provider, the focus is on:

Don't wait for 'significant harm' - you don't need to wait until you think a child is being abused or neglected before information sharing becomes relevant. You don't need a list of concerns before raising them. The new framework is intended to support early identification and support, not just child protection. If you notice a pattern of concerns, you should feel able to approach the appropriate safeguarding or early help service rather than wondering if it's serious enough yet.

You don't normally need parental consent before safeguarding information can be shared. This doesn't mean you should stop talking to parents - you should continue to be open and transparent wherever it is safe and appropriate, but you shouldn't treat lack of permission as an automatic reason not to share safeguarding information. There are circumstances when telling a parent first could increase the risk to the child and those situations must be treated with care.

Data protection law does not, by itself, prevent lawful safeguarding information sharing - early years providers must still comply with applicable data protection requirements when sharing information. For example, you might have been told or trained previously that you can't share information because of GDPR / data protection legislation. However, the new duty is intended to address exactly this kind of uncertainty. UK data protection law still applies. You must make sure you are using the appropriate lawful basis and meeting the other data protection requirements when sharing information. The updated statutory duty provides a legal basis for sharing when its conditions are met.

For an early years provider, the answer shouldn't be that you cannot share because of GDPR. Instead, you should consider whether the information is relevant and whether the statutory conditions for sharing are met. You should take advice if you are unsure and record the decision-making process and final decision.

You might be asked for information about a child - for example, children's social care, the local authority, police or another relevant safeguarding organisation might contact you and ask whether you have noticed anything concerning about the child. The new duty applies to requests for information as well as proactive information sharing. However, you will need to be clear about processes - for example, you should have a clear process for:

• Who deals with information requests - usually the designated safeguarding lead (DSL) but think about who will cover if they are on holiday.
• Checking who is making the request - you must ensure the person contacting you is legitimately part of the organisation.
• Recording the request - your local authority might provide paperwork.
• Identifying what information you hold - if you have any concerns about a child's safety or wellbeing, you should already have a child safeguarding file in place, but you might also need to look back at attendance registers, accident, incident or medication records etc which must be filed so you can access them quickly.
• Deciding what is relevant - you might need to take advice from the police or safeguarding partners.
• Sharing securely - for example, is your normal email provider considered a secure platform?
• Recording what you shared and why - this should be part of the child safeguarding file record keeping.

For an early years provider, this updated information might be included into your Safeguarding Policy rather than being a standalone system.

Keep records of your decisions

You will need to record:

• The date and time of the decision (or request).
• What did I know? What concerned me?
• Who did I speak to about this? Did I take advice first - if so, from whom and when?
• What information did I share - did I share in full, in part or decide not to share?
• Who did I share it with?
• Why did I consider it relevant?
• What was my lawful basis for sharing?
• Did I consider the impact of sharing on the child?
• Was information shared securely?
• What happened afterwards?

This is very important whether you decide to share or not. The updated statutory guidance doesn't turn every concern into an automatic referral - professional judgement remains important and should be recorded, to make the decision-making process transparent.

Updating policies

You might need to look at your policies, especially around anything that says, 'parental consent is always required before information can be shared', 'data protection prevents us from sharing unless…' or 'information can only be shared where there is a safeguarding concern', including:

• Safeguarding Policy.
• Information Sharing Policy.
• Confidentiality Policy.
• Privacy Notice.
• Recording and reporting procedures.
• Induction and ongoing training for staff.

You might also need to review arrangements for working with the safeguarding team / children's social care. From 30 September 2026, the section 16LA information-sharing duty and associated statutory guidance form the new statutory framework. Existing DfE information-sharing material should be read alongside the new statutory framework and should not be relied upon where it conflicts with the new statutory guidance or legislation. Also note that the '7 Golden Rules for Information Sharing' are no longer listed or included in the new statutory guidance.

Other legislation links

• EYFS 2026 - many of the recent changes.
• Working Together to Safeguard Children 2026 - how you work with other safeguarding agencies.
• Keeping children safe in education 2026 (paragraph 144).
• The new information sharing duty - when and how information should be shared.

They all link together, making the expectation of early identification and multi-agency working and appropriate information sharing much clearer.

Putting everything together: if you have information that could help another relevant organisation safeguard a child or promote their welfare, you should no longer let uncertainty about consent, confidentiality or GDPR stop you from sharing it when the legal conditions for sharing are met.

However, you are not expected to become a social worker - you still use your professional judgement, follow your Safeguarding Policy and contact the appropriate safeguarding services if you are concerned about a child and take advice if you are unsure. When you have made your decisions, you will need to record them in the child safeguarding file, including the legal basis for sharing (or not sharing).

We hope this is useful as a starting point, but we are not legal advisors. If you have any questions you should speak to your safeguarding partners and / or the Information Commissioner's Office.

Download our FREE statutory sharing information quick overview

Our experts have produced a FREE statutory sharing information quick overview PDF about the changes from 30 September 2026

Download the free quick overview guide