Data Protection and Safeguarding

It is important to note that UK Data Protection law provides no barrier to voicing concerns to a safeguarding authority when it concerns vulnerable children and adults. 

In fact, UK law provides a pathway to allow you to make an assessment of the risk to the data subjects, along with the process of sharing with others who can provide protection.

Following the death of Arthur Labinjo-Hughes, and subsequent jailing of his Father and Step-Mother for his death, I wanted us to highlight that Data Protection Law is no barrier to sharing information with safeguarding teams.  Whilst public authorities need express powers to share information, I have adapted a scenario to show a logical flow of actions a Data Controller can take to ensure that they “share” concerns first.

This follows a logical flow of management actions that justifies sharing. We await the public inquiry to determine if this was the case but there is form.

Is data protection law a hindrance?

In my studies, I have seen serious case reviews highlight the risk of professionals caught like rabbits in headlights fearing Data Protection Law a hindrance. This is not the first such horrific case of child abuse. In 2000, Victoria Climbié died after being admmitted to hospital with 128 different injuries, caused by adults who should have been providing care.  Those adults were eventually sent to prison for her murder. A public inquiry led by Lord Laming changed the way authorities deals with these cases.

In an official inquiry report into her death and the failings of the system, it was stated that professionals were reluctant to share information on her welfare which contributed to her death.  Lord Laming stated in s.146 of the report:

However, I was told that the free exchange of information about children and families about whom there are concerns is inhibited by the legislation on data protection and human rights. It appears that, unless a child is deemed to be in need of protection, information cannot be shared between agencies without staff running the risk of contravening this legislation. This has two consequences: either it deters information sharing, or it artificially increases concerns in order that they can be expressed as the need for protection.  (s.146  The Victoria Climbié Inquiry)

The full report can be read here.

Data sharing for public authorities

We at DPAS run a Data Sharing Course, but it might be timely to develop this course further to support Public Authorities.  This may help them understand the legal gateway allowing them to share information relating to those at risk.  In the meantime I hope the scenario will assist in understanding some of the main considerations and learning points required in these situations. 

However in conclusion my request to you is simple. “If in doubt, share!”

Keep attacking.

If you’re interested in attending any of the courses that we offer, you can see our upcoming events here.

To get in touch, feel free to use our contact form, or call 0203 3013384.

Meet the Team Nigel Gooding

by Nigel Gooding, LLM Information Rights Law & Practice

Nigel is founder of the Data Privacy Advisory Service, and he plays a vital part in our success. Due to his extensive experience, Nigel is recognised as a leading expert in the industry.

related posts

Halloween-themed illustration for a blog about GDPR audits and data protection risks
Melanie Garnett

Skeletons in the Server Room

The scariest data protection risks are the ones you can’t see. From zombie data to ghost suppliers, here’s how an independent GDPR audit helps you find what’s lurking and deal with it with confidence.
These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?

Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.

Read More »
Melanie Garnett

Your data protection policies are written. Are they actually working?

While most organisations recognise internal policies such as a Data Protection, Data Breach, Retention, or Subject Access Request Policy, as vital components of the data protection compliance framework, simply having them written is only part of the equation.

These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?

Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.

Read More »
Alex Haslam

DPAS Data Protection Bulletin – September 2026

Welcome back to our monthly DPAS bulletin, where we cover the latest data protection news and developments from around the world.

Ever wondered how a routine government spreadsheet leak turns into a two-year covert court order? How about why the police might feel your mother-in-law’s contact details were key to national security? Have you ever pondered how many working weeks it takes to read a cookie banner? Whether Wall Street knows about your last GP visit? Or if you’re in Australia (g’day) why an AI is sending notes on your worst rashes to faraway cloud servers?

Read about all this and more in our latest DPAS Data Protection Bulletin.

Read More »
Bethany Meredith

Navigating SAR Chaos: Why PDF Conversion and Deduplication Are Your Secret Weapons

When a Subject Access Request lands in your inbox, the one-month clock starts ticking immediately, and the real bottleneck usually isn’t finding the data, it’s wading through duplicate files and endless email threads. Discover why deduplication and PDF conversion aren’t just nice-to-haves but non-negotiable steps in your SAR pipeline: cutting review volume by up to 60%, closing redaction loopholes, and delivering a secure, universally accessible disclosure , all while keeping your compliance team sane and your deadline intact.

Read More »

Get a Free Consultation