Food Hygiene
Health & Safety
Safeguarding
First Aid
Business Skills
Personal Development
Most people who hold back on a safeguarding concern aren’t careless. They’re scared of breaking confidentiality, scared of GDPR, scared of getting it wrong.
That fear is backwards. Serious case reviews keep finding the same failure: someone knew something and didn’t pass it on. The law is far more on your side than you think. This guide shows you exactly when you can share, when you shouldn’t, and how to record the decision so it holds up.
Table of Contents
The short answer most people get wrong
You can share information about an adult safeguarding concern when:
- the adult consents, or
- the adult lacks capacity and sharing is in their best interests, or
- sharing is necessary and proportionate to prevent harm, even without consent.
That third point is where most people freeze. Here’s the thing: the Care Act 2014 doesn’t contain a standalone “information sharing” rule because it doesn’t need one. The rules come from the common law duty of confidentiality, the UK GDPR and Data Protection Act 2018, the Human Rights Act (Article 8, the right to privacy) and the Mental Capacity Act 2005. All of them allow sharing when someone’s safety is at stake.
Start with consent, because it's the right first move
Asking first isn’t just a legal box to tick. It’s the heart of Making Safeguarding Personal: what does the adult want to happen?
In the training sessions I run, the question I hear most is “Do I need permission before I tell my manager?” Not for internal advice. You can always talk to your designated safeguarding lead, anonymously if you need to, before deciding anything.
When you do ask for consent:
- Explain plainly what you want to share, with whom, and why
- Tell them what could happen next
- Accept that “no” is a valid answer from someone with capacity, in most cases
- Write their answer down in their own words
Capacity changes everything
The Mental Capacity Act 2005 says you must assume the person has capacity unless it’s shown otherwise. Capacity is decision-specific, so someone can manage their shopping but not understand the risks of financial abuse.
If the adult lacks capacity to decide about sharing, you can make a best-interests decision. Involve family or an advocate where appropriate, and choose the least restrictive option.
If they have capacity and refuse, you usually respect that. Usually.
When you can share without consent
This is the section competitors skim over. You can share even when a capacitated adult says no if:
- Other people are at risk. Children, other residents, or other adults with care needs.
- A crime has been, or may be, committed. Assault, theft, fraud, sexual offences.
- There’s a risk to life or serious harm. This is vital interests territory.
- Coercion or undue influence is driving the refusal. “No” from someone being controlled isn’t a free choice.
- A staff member or volunteer is implicated. Employers and regulators need to know.
- The law requires it. A court order, or a Safeguarding Adults Board request under section 45 of the Care Act.
- There’s a wider public interest that outweighs the person’s privacy.
Where it’s safe to do so, tell the adult you’re sharing and why. Don’t tell them if doing so would increase the risk, for example by tipping off an abuser.
The legal bases nobody explains properly
Most guides just say “GDPR isn’t a barrier.” True, but you need to know why.
UK GDPR Article 6: your lawful basis
Choose one:
- Public task. Councils, NHS bodies and the police carrying out safeguarding duties, including section 42 enquiries.
- Vital interests. Someone’s life is at risk.
- Legal obligation. You’re required to share.
- Recognised legitimate interest: safeguarding. New under the Data (Use and Access) Act 2025 (Article 6(1)(ea)). It lets organisations process data where it’s necessary to safeguard a vulnerable individual, with no balancing test. It’s especially useful for charities, care providers and private organisations. Check the current ICO guidance before relying on it.
Special category data: the extra condition
Health, ethnicity and sexuality data need an extra condition too. The key one is DPA 2018 Schedule 1, paragraph 18: “safeguarding of children and individuals at risk.” It applies when consent can’t be given, can’t reasonably be obtained, or asking would put the person at risk.
Caldicott Principle 7 (health and care)
In health and care settings, Caldicott Principle 7 says the duty to share information can be as important as the duty to protect confidentiality.
Share the minimum, through the right door
Once you’ve decided to share, be precise about how. Information should be:
- Necessary. Only what’s needed for the purpose.
- Proportionate. Not the whole file when one incident note will do.
- Relevant and accurate. Facts kept separate from opinion, and dated.
- Timely. Delay can be its own harm.
- Secure. Use encrypted email, the council’s referral portal, or a phone call followed by written confirmation. Never WhatsApp.
Who to share with: your safeguarding lead, the local authority adult safeguarding team, the police where a crime is suspected, and health professionals involved in the person’s care. Not curious colleagues. Not family “just to keep them in the loop.”
Three quick scenarios
Scenario 1: Maya has capacity and says no
Maya, 78, says her son “borrows” her pension, and she doesn’t want trouble. There’s no sign of coercion and nobody else at risk. Respect her wishes, offer support, get anonymised advice, record everything, and keep reviewing.
Scenario 2: Same situation, but children live there
Her son lives with two young grandchildren. Now there’s a possible risk to others. Share.
Scenario 3: Ade lacks capacity about his finances
Ade, 34, has a learning disability and lacks capacity about his finances. A “friend” has moved in and taken over his bank card. Make a best-interests decision and refer to the local authority. The police may need to be involved too.
Someone in a session once asked me, “What if I share and I’m wrong?” If you acted in good faith, shared proportionately and recorded your reasoning, you’re on solid ground. Getting it wrong by staying silent is far harder to defend.
What to do now
Don’t wait for a real concern to work this out. This week:
- Find your organisation’s safeguarding and information sharing policy, and actually read it
- Save the contact details of your local adult safeguarding team
- Know who your designated safeguarding lead is
- Copy the recording template above into your team’s system
If you’re not sure your team would make the right call under pressure, that’s a training gap, not a personal failing. [Internal link: Safeguarding Adults Level 2/3 course] covers capacity, consent and information sharing with real case studies.
Share wisely. But when someone’s safety is on the line, share.
Frequently Asked Questions (FAQ)
Can you share safeguarding information without the adult's consent?
Yes, in specific circumstances. You can share without consent if other people are at risk, a crime has been or may be committed, there is a risk to life or serious harm, the adult is being coerced, a staff member is involved, or the law requires it. The adult must lack capacity for a best-interests decision to apply. In every case, share only what is necessary and record why you did it.
Does GDPR stop me reporting a safeguarding concern?
No. Data protection law is not a barrier to sharing information to keep someone safe. UK GDPR gives several lawful bases, including public task, vital interests and, since the Data (Use and Access) Act 2025, a recognised legitimate interest for safeguarding vulnerable people. The Data Protection Act 2018 also has a specific condition for sharing sensitive information to safeguard individuals at risk.
What if the adult has capacity and refuses consent?
Respect their wishes unless an override applies: others are at risk, a crime is involved, there is serious risk to life, the person is under coercion or undue influence, or a legal duty applies. Even if you don’t share, you can still get anonymised advice from your safeguarding lead. Record the refusal, the support you offered, and how you’ll keep checking the risk.
Who can I share safeguarding information with?
Only people who need it to protect the adult. Usually that’s your designated safeguarding lead, the local authority’s adult safeguarding team, and the police where a crime is suspected. It can also include health professionals or the Safeguarding Adults Board. Don’t share with family, colleagues or other agencies just because they’re curious or nearby.
What should I record when I share safeguarding information?
Record what you shared, who you shared it with, when, how, and why. Note whether you had consent or which override applied, plus the legal basis you used. If you decided not to share, record that too, with your reasons. This record protects the adult, you and your organisation if the decision is reviewed later.
