as early as possible to help identify, assess and respond to risks or concerns about the safety and welfare of children, whether this is when problems are first emerging, or where a child is already known to local authority children’s social care. 117. It is important that governing bodies and proprietors are aware that among other obligations, the Data Protection Act 2018, and the UK General Data Protection Regulation (UK GDPR) place duties on organisations and individuals to process personal information fairly and lawfully and to keep the information they hold safe and secure. 118. Governing bodies and proprietors should ensure relevant staff have due regard to the relevant data protection principles, which allow them to share (and withhold) personal information, as provided for in the Data Protection Act 2018 and the UK GDPR. 34 This includes: • being confident of the processing conditions which allow them to store and share information for safeguarding purposes, including information, which is sensitive and personal, and should be treated as ‘special category personal data’ • understanding that ‘safeguarding of children and individuals at risk’ is a processing condition that allows practitioners to share special category personal data. This includes allowing practitioners to share information without consent where there is good reason to do so, and that the sharing of information will enhance the safeguarding of a child in a timely manner. It would be legitimate to share information without consent where: it is not possible to gain consent; it cannot be reasonably expected that a practitioner gains consent; and, if to gain consent would place a child at risk, and • for schools, not providing pupils’ personal data where the serious harm test under the legislation is 