Sharing information safely in everyday SEND practice

SEND work runs on information: reports from therapists, health plans, family circumstances, safeguarding concerns. Sharing the right information with the right people is what keeps pupils safe and well supported. Sharing it carelessly is one of the most common causes of data breaches in schools.

Start from "need to know"

Before sharing, ask two questions: does this person need this information to support the pupil, and do they need all of it? A lunchtime supervisor may need to know a pupil's allergy and how to respond to it, but not their full medical history. A supply teacher needs the pupil's communication profile, not the minutes of their last annual review.

Choose a secure route

• Use school systems, not personal ones. No personal email accounts, messaging apps or personal phones for pupil information.
• Avoid attachments where you can. Sharing a record within a secure system is safer than emailing a document that can be forwarded.
• Check the recipient before you press send. Autocomplete in email is behind many reported breaches.
• Lock printed copies away and collect them from printers straight away.

Be clear with families

Parents and carers should know what you record, why, and who it's shared with. Your privacy notice sets this out, but a simple conversation at the start — particularly when outside agencies are involved — builds trust and avoids surprises later. Where you rely on consent for a particular share, record it.

Safeguarding is different

Data protection law is not a barrier to sharing information to keep a child safe. Statutory safeguarding guidance is clear that fears about sharing information must not stand in the way of protecting children. Where there's a safeguarding concern, share it with the designated safeguarding lead promptly, record what was shared, with whom and why, and follow your school's procedures.

Record decisions, not just information

When you decide to share — or not to share — note the reason. It protects the pupil, the school and you, and it makes reviewing decisions much easier if questions are asked later.

A worked example

A pupil with an EHCP is moving to a new class next term. Over the summer, the new teacher needs the pupil's communication profile, current targets and medical plan. The old approach was to email a folder of attachments to the teacher's address, copying in two teaching assistants. One of those assistants had left the school, and the email went to an account that was no longer monitored.

Now the school shares access to the pupil's record instead. The new teacher sees the profile, targets and health plan inside the school's system, with access that ends automatically if they move on. The medical plan is also shared, through the same route, with the midday supervisor who will be on duty, but the full review history isn't. Nothing leaves the school's system, and there is a record of who viewed what.

Common pitfalls

• Group emails with attachments. These are easily forwarded and hard to recall.
• Oversharing for convenience. Sending everything "just in case" increases risk without helping the pupil.
• Inconsistent practice with outside agencies. Agree secure routes with therapists and other professionals at the start.
• Forgetting printed copies. Paper left on desks or in staffrooms is still a data breach.

Questions to discuss with your team

• What are our approved routes for sharing pupil information inside and outside school?
• Who needs each type of information, and do they currently get more than they need?
• How do we record sharing decisions, especially for safeguarding?
• When did staff last have a short refresher on data protection?

Quick checklist

• Information is shared on a need-to-know basis, and only what's needed.
• Pupil information stays in school systems, never personal accounts or devices.
• Families know what is recorded and who it's shared with.
• Safeguarding concerns go to the DSL promptly and are recorded.
• Sharing decisions, and the reasons for them, are written down.

Explore: SEND management software · EHCP management software · special school software

Sources

• Data protection in schools (DfE)
• Information sharing: advice for practitioners (HM Government)
• Keeping children safe in education (DfE)

General guidance for school staff, last reviewed 5 November 2026. Statutory guidance changes, so always check the latest version on GOV.UK.