Data-sharing decision checklist
- Version
- v1
- Updated
- 7 October 2026
- Reviewed
- 7 October 2026
- Who this checklist is for
- Primary and secondary schools in England, including maintained schools and academies, considering proposed sharing of personal information with another organisation.
- Jurisdiction
- england
19 checklist steps
Blank response areas · preview only
Record the proposed sharing
Response required
Describe the proposed sharing, including whether it is an individual decision or a recurring arrangement.
Describe the proposed sharing and state whether it is individual or recurring.
State the purpose
Response required
Record the specific purpose for sharing the personal information.
State the specific purpose.
Check the purpose
Confirm that the proposed purpose is clear and relates to the decision to share.
- Yes
- No
- Not applicable
Notes
Assess necessity
Response required
Record why sharing is necessary for the stated purpose and identify any less intrusive way of achieving that purpose.
Explain why sharing is necessary and record alternatives considered.
Record the lawful basis
Response required
Identify and record the lawful basis relied on for the proposed sharing.
Record the lawful basis and the reasoning supporting it.
Check special-category or criminal-offence information
Consider whether the proposed sharing includes special-category personal data or criminal-offence data. If it does, record the additional condition or legal requirement being relied on.
Choose one
- Neither is included
- Special-category personal data is included
- Criminal-offence data is included
- Both are included
- Uncertain and requires advice before proceeding
Specify the information
Response required
List the personal information proposed for sharing and distinguish information that is necessary from information that is not necessary.
List the categories and specific items of information proposed for sharing.
Identify the recipient
Response required
Record the receiving organisation, relevant team or person, and the role they will have in receiving or using the information.
Record the recipient organisation, team or person, and role.
Check the recipient's intended use
Response required
Record how the recipient is expected to use the information and whether that use is consistent with the stated purpose.
Describe the recipient's intended use and its connection to the purpose.
Consider the individuals' interests
Response required
Record the likely benefits, disadvantages and risks to the people whose information is being shared, including any reasonable expectations they may have.
Record benefits, disadvantages, risks and reasonable expectations considered.
Consider children's interests where relevant
Complete this step only where the proposed sharing concerns children or may affect children. Record the children's interests, welfare and any age- or vulnerability-related considerations relevant to the decision.
If relevant, record the children's interests, welfare and other relevant considerations.
Record safeguarding relevance where applicable
Complete this step only where the proposed sharing relates to safeguarding or a safeguarding concern. Record the relevant concern, urgency and safeguarding route considered.
If relevant, record the safeguarding context and route considered.
Assess risks
Response required
Record risks arising from the proposed sharing, including risks of inaccurate, excessive, unauthorised or insecure disclosure and any risks from onward use or sharing.
List the identified risks and who may be affected.
Specify safeguards
Response required
Record the safeguards that will apply before, during and after sharing, including controls for accuracy, access, security, retention, deletion and onward disclosure where relevant.
Record the safeguards, responsibilities and any arrangements with the recipient.
Check transparency and individual rights
Response required
Record how relevant individuals will be informed and how requests or rights relating to the shared information will be handled, unless a documented reason means this does not apply.
Record the transparency approach, rights handling and any documented exception.
Decide the outcome
Select the current outcome based on the information recorded in this checklist.
Choose one
- Share
- Do not share
- Delay pending further information or controls
- Seek advice or authorisation before deciding
Record the decision reasoning
Response required
Explain the decision, including how the purpose, necessity, lawful basis, risks, safeguards and any conditional considerations informed the outcome.
Record the decision and the reasons for it.
Record authorisation or review
Response required
Record the person or role responsible for authorising or reviewing the decision, together with any conditions, actions, review point or escalation required.
Record the responsible person or role, conditions, actions and review arrangements.
Retain the decision record
Store this completed decision record with the relevant supporting information and keep it available for any later review of the sharing arrangement.
- Yes
- No
- Not applicable
Notes