It’s best practice to gain someone’s consent before sharing their personal information. To give consent they must be fully informed, competent and able to make this decision of their own free will without undue pressure from others. They have the right to withdraw their consent at any time, and should be made aware of this.

Additional guidance exists for gaining consent to share personal information relating to a child (aged under 18) – see below.

Cases where you do not need to gain consent

In certain circumstances it may not be safe or appropriate to gain consent. You do not need to gain someone’s consent (in the case of a child, their own consent and/or parental consent) if any of the following apply:

  • if someone has been hurt and information needs to be shared quickly in order to help them
  • if there is a risk of harm to the person, or others, and seeking consent would threaten their safety
  • if the person is being threatened or coerced
  • if sharing information could prevent a crime from being committed, prejudice a criminal investigation, or prevent someone from being caught or questioned in relation to a crime
  • if the person’s capacity to give consent is in doubt – if this is the case and they are over 16 years old, the Mental Capacity Act (2005) will apply and the person’s mental capacity will need to be assessed (see below).

If you cannot gain consent from the person, if safe to do so you should explain your duty to share your concerns. You should also make a record of your decision to share information without their consent.

  • Consent and children

    Unless the above circumstances apply, it is best practice to gain both child and parental consent if you wish to share personal information relating to anyone under the age of 16.

    Gaining a child’s consent – children have the right to provide consent for sharing their personal data and can exercise this right if they are considered to have the competence and mental capacity to do so. This means you should discuss your intention to share a child’s personal information with them, and seek their consent.

    Children under 12 are not generally considered competent to make decisions over consent, and there may be circumstances where a child aged between 12 and 16 is also not considered competent. Under these circumstances consent should be sought on behalf of the child from someone holding parental responsibility.

    Gaining parental consent – if you are concerned about a child (including those aged 12 or over who are considered competent) you must speak to someone with parental responsibility for the child before sharing their personal information.  Parental consent is not a prerequisite for sharing personal information about a child but a lack of consent can hinder the provision of support.

    You are not required to gain parental consent if specific child protection needs have been identified or if asking for parental consent would put the child at risk of harm or distress. See the above list for further situations where you do not need to gain child or parental consent.

  • The Mental Capacity Act (2005)

    The Mental Capacity Act applies to people over the age of 16.

    If you have reasonable belief that someone lacks the capacity to make decisions about sharing their personal information you must consider and record this conclusion and make a ‘best interest’ decision in line with the Mental Capacity Act.

    If you need to make a ‘best interest’ decision follow the best interest guidance developed by the Devon Safeguarding Adults Partnership.

    For further guidance refer to the Mental Capacity Act Code of Practice (2005) and the advice on the Devon Safeguarding Adults Board website.

  • What should I do if someone is reluctant to give consent?

    If someone is reluctant to gain consent you can try the following

    • explain the benefits of sharing information – could it enable them to access help and support?
    • discuss the consequences of not sharing information – could it result in someone being harmed?
    • reassure them that their information will not be shared with anyone who does not need to know
    • reassure them that they are not alone and that support is available to them.

    If someone is still unwilling to give consent you must respect their wishes unless circumstances dictate that you do not need to gain their consent (see above).

  • What should I do if I suspect someone is being exploited and this is impacting their ability to provide consent?

    Perpetrators of exploitation use power, coercion and control over others – this can influence someone’s freedom and capacity to tell others about their situation and make a safeguarding referral on their behalf.

    You may be concerned about speaking to someone about their situation or asking them to provide consent for a safeguarding referral – this could put them or others at risk. If you feel someone is being exploited or is at high risk of exploitation and you are unable to gain their consent you should still consider making a safeguarding referral.

    You find examples of these situations in these case studies about exploitation and consent.