Information sharing in an urgent situation or emergency
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Control measure: There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.
Risk: By not sharing information urgently or rapidly there could be a real risk to public health and safety or serious harm to a person, and a risk of causing more harm.
Ways to meet our expectations:
- Consider and document the types of information you are likely to need to share in advance and where this is held.
- Document clear plans that outline when and how you share information in an emergency and who has authority to make these decisions.
- Include a risk assessment as part of any pre-existing DPIA, and refer to business continuity and disaster recovery plans.
- Consider and document all security measures that you will take if you are required to share in an urgent situation or emergency.
- Put data sharing agreements in place for this type of emergency sharing in advance, where you know the likely sharing partners.
- Train staff on emergency plans and how to share information in these situations.
Options to consider:
- Run tests or simulations to check that plans and training are adequate and effective.
- Document the risks of not sharing in these situations.