nsent is not generally the most appropriate lawful basis to rely on when sharing information for safeguarding or child welfare purposes. The UK GDPR sets a high standard for consent. It must be specific, freely given, unambiguous, time limited and capable of being withdrawn. The data subject (the individual to whom the personal information relates) must have given consent freely and without conditions attached to the processing of their personal information for one or more specific purposes. The individual must also be allowed to freely withdraw their consent at any time and the processing of that data must stop. Data Protection Impact Assessment (DPIA) A DPIA32 is a risk assessment process designed to help you analyse, identify and minimise data protection risks of a project or plan. It is a key part of your accountability obligations under the UK GDPR and demonstrates how you comply with all of your data protection obligations. Whilst DPIAs are only mandatory where there is high risk to individuals, as is the case with children due to their vulnerability, they are a useful tool when planning a data share, to help users justify their reason and to establish a lawful basis for sharing. You should carry out a DPIA to assess and mitigate risks to the rights and freedoms of children. A DPIA must be completed before the processing or sharing commences to adequately assess the risks and mitigate them. DPIAs do not have to be complex or time-consuming in every case, but there must be a level of rigour in proportion to the privacy risks arising. There is no definitive DPIA template33 that you must follow, which means that you can develop your own template and process to suit your particular needs. However, the ICO website provides a template for you to use. A previous or exist