Home > My Council > Data Protection > Privacy Notices > Child Protection - Information Sharing

Child Protection - Information Sharing

Childrens Services

Child Protection-Information Sharing (CP-IS)

January 2022 – Phase 1

NHS Digital operates a system known as the Child Protection Information Sharing system (CP-IS). This system helps health and social care staff in England to share information about child protection plans securely, to better protect society's most vulnerable children.

When a child is known to social services and is a Child Looked After (CLA), on a Child Protection Plan (CPP) or Unborn Child Protection Plan (UCPP), basic information about that plan (referred to in this notice as CP Information) is shared securely with the NHS through CP-IS. 

Within the CP-IS, Local Authorities (Rutland County Council) and Healthcare providers are the Data Controllers for their data. NHS Digital is the Data Processor. 

Page Content

Information (personal data) collected & processed:

The CP information that NHS Digital is extracting from CP-IS is NHS Number and date of birth so we can identify the child or mother (if the mother is pregnant with an unborn child protection plan).  We also collect what type of plan exists (or if a looked after child) and the start and end date of that plan so the healthcare professional knows whether or not it is still in place.  We will not be obtaining or sharing child protection plans as they are not held on CP-IS. They are held by local authorities and shared locally under existing safeguarding arrangements where this is appropriate.

The CP information also includes audit data of health access to CP-IS records for the last 25 presentations at unscheduled healthcare. This audit data is created and held by NHS Digital whenever a protected child presents at an unscheduled care setting that is already accessing CP-IS.

Agencies & partners we might share the information with:

During the period 2014 – 2021 the service has been rolled out to over 1,200 NHS care locations within the 7 settings and to all of the 152 Local Authorities.


Government Departments and Arm’s Length Bodies

  • Department of Health and Social Care
  • Department of Education
  • NHS England and NHS improvement
  • NHS England/Improvement Designated Safeguarding Leads and Networks
  • NHS Digital
  • Public Health England
  • National Data Guardians Office *after first draft is agreed
  • Information Commissioner’s Office (ICO) *after first draft is agreed


Local Authorities:

  • Association of Directors of Children’s Services
  • Local Authority Directors of Children’s Services
  • Children’s Social Care System Suppliers


Health Care:

  • Royal College of Emergency Medicine
  • Royal College of Paediatrics and Child Health
  • Royal College of Midwives
  • Royal College of Nursing
  • Royal College of General Practitioners
  • Clinical Commissioning Groups
  • NHS Trusts including Designated Safeguarding Nurses
  • Ambulance Trusts and Ambulance Safeguarding Group
  • Safeguarding Managers in Acute, Out of Hours, Minor Injuries, Ambulance and Walk In care settings
  • Community Pharmacy Leads
  • The Joint GP IT Committee
  • NHS approved and/or commissioned Information System Suppliers

Purpose for processing your personal data:

The purpose of the processing of data in the Child Protection - Information Sharing (CP-IS) system is to share key information regarding protected children with health and care professionals who need to know whether a child is on a protection plan or is looked after with care professionals, as they have a statutory responsibility and professional duty of care to ensure the health and wellbeing of a child.

This information is needed so health and care workers can assess the risks to the child and determine the right care and support pertaining to their health and welfare and any appropriate actions that may be necessary. This data will allow opportunity for the social worker to be informed of the attendance in any health setting and to assess whether an intervention may be necessary to safeguard and protect the child. 

Sharing this data will provide care professionals with information from the CP-IS system about children subject to a Child Protection Plan (CPP), pregnant women with an Unborn Child Protection Plan (UCPP) and children who are designated a Child Looked After (CLA). These are the data subjects for CP-IS.

 These are children being cared for under the following sections of the Children’s Act 1989:  

  • Full Care Order (Section 31)  
  • Interim Care Order (Section 38)  
  • Voluntary Care Agreement (Section 20)  

Health practitioners are in an opportune position to identify welfare needs or safeguarding concerns regarding individual children when they present to services and can provide support where appropriate. This includes:

  • understanding risk factors,
  • communicating and sharing information effectively with children and families,
  • liaising with other organisations and agencies,
  • assessing needs and capacity,
  • responding to those needs and contributing to multi-agency assessments and reviews.

The vast majority of care settings and professionals have this safeguarding responsibility defined as part of their professional responsibilities.  Health practitioners have a critical role to play in safeguarding and promoting the welfare of children including:

  • GPs,
  • paediatricians,
  • nurses,
  • health visitors,
  • midwives,
  • school nurses,
  • allied health practitioners,
  • those working in maternity,
  • Great Ormond Street Hospital (unscheduled admissions & emergency transfers),
  • unscheduled and emergency care settings.

Several of the above care settings have multiple tiers and focus of providing care – all of the levels are expected to be covered.  The title and structure of these services can vary locally. For example, mental health has four levels of care and some specialist functions; sexual health has a broad range of services from walk in clinics through to centres for assessing sexual assault.

The scope of Phase 1 (2014 – 2020) covered:

Unscheduled care in NHS England:

  • Local Authority Children’s Services​
  • Emergency Departments​
  • Walk-in Centres
  • Minor Injury Units​
  • Ambulance services​
  • GP Out of Hours​
  • Direct access to Paediatric wards
  • Great Ormond Street Hospital (unscheduled admissions & emergency transfers),

Our lawful basis for processing the personal data:

Legal basis for the processing by Local Authorities (Rutland County Council) (collection and disclosure):


  • Schedule 1 of the Data Protection Act 2018 contains 'safeguarding of children and individuals at risk' as a processing condition that allows practitioners to share information, including without consent (where, in the circumstances consent cannot be given, it cannot be reasonably expected that a practitioner obtains consent, or if to gain consent would place a child at risk).
  • General lawfulness of processing personal data:
  • Article 6(1)c: processing is necessary for compliance with a legal obligation to which the controller is subject
  • Article 6(1)e: processing is necessary for the performance of a task carried out in the public interest or the exercise of the official authority vested in the controller
  • Processing of special categories of personal data:
  • Article 9(2)h: processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to with the Schedule 1, Part 2 of of the DPA 2018 substantial public interest condition being paras 6 (6. Statutory and government purposes) and 18 (Safeguarding of children and individuals at risk) with the underlying law being the Children Act 2004 and the statutory guidance Working Together to Safeguard Children
  • Article 9(g) Reasons of substantial public interest (with a basis in law), Data Protection Act 2018 with the Schedule 1, Part 2 of the DPA 2018 substantial public interest condition being paras 6 (6. Statutory and government purposes) and 18 (Safeguarding of children and individuals at risk) with the underlying law being the Children Act 2004 and the statutory guidance Working Together to Safeguard Children.

Personal data disposal and retention:

Clinicians are viewing the live record, this view is not retained.  The CP-IS information is only shown if a child is actively on a plan and during the following 364 days after the end of their last plan. 

Clinicians or child health information services (CHIS) receive a file which is then deleted after use.  For CHIS, the use does include importing the information into their local system, and onward sharing with 0-19 Services, namely School Nursing and Health Visitor services.  Each will keep a record in their local systems.

If the care professional re-keys the information into their own systems they will then have a record of the child being on a plan associated with the healthcare event.

Clinicians are obliged to keep contemporaneous notes including important contextual information, such as the existence of a protection plan, to demonstrate that they considered the child’s full health and care context in clinical decision making and any actions they took e.g. following up any concerns colleagues.  As such, the information may be inputted manually into systems when decisions are taken or by those organisations that have received a referral. 

Each healthcare organisation has its own record retention rules in line with national guidance.  The national guidance for record keeping for children’s records are for extended periods of time.  This is because children’s records may be referred to many decades afterwards.  For protected children this requirement is particularly relevant due to the potential concerns that may arise.

Access to CP-IS is audited, it captures the name of the person who accessed the record, their role and the date and time. If a child is Looked After or on a Child Protection Plan, it is the staff’s statutory responsibility and duty to contact social care and provide details of the reason for attendance. This has been outlined within the standard operating procedure for each pilot site, with the exception of sexual health.


Cookies are small text files that are placed on your browser. To see how we use cookies, please follow this link.

Your rights as a data subject:

By law, you have a number of rights as a data subject and this does not take away or reduce these rights. Your rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.

All information is processed in accordance with the Rutland County Council data protection policy, please follow this link.

These rights are:

  • Your right to get copies of your information – you have the right to ask for a copy of any information about you that is used.
  • Your right to get your information corrected – you have the right to ask for any information held about you that you think is inaccurate, to be corrected
  • Your right to limit how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used.
  • Your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case.
  • Your right to get information deleted – this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case.

Further information regarding to your data rights and how the Council will process your information please visit our website at www.rutland.gov.uk/dataprotection

If you are concerned about how we process your personal data:

If you are unhappy or wish to complain about how your personal data is used as part of this programme, you should contact Rutland County Council Data Protection Officer in the first instance:

Data Protection Officer
Rutland County Council


If you are still not satisfied, you can complain to the Information Commissioners Office. Their website address is www.ico.org.uk and their postal address is:


Information Commissioner's Office
Wycliffe House
Water Lane


We use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited, and the audits are reviewed at senior level.

Automated decision making or profiling:

No decision will be made about you solely on the basis of automated decision human involvement) which has a significant impact on you. 

Changes to our policy:

We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on our website. This privacy notice was last updated in January 2022
Was this information helpful?
Was this information helpful?
Was this information helpful?