Control measure: There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.
Risk: By not sharing information urgently or rapidly there could be a real risk to public health and safety or serious harm to a person, and a risk of causing more harm.
Ways to meet our expectations:
- Consider and document the types of information you are likely to need to share in advance and where this is held.
- Document clear plans that outline when and how you share information in an emergency and who has authority to make these decisions.
- Include a risk assessment as part of any pre-existing DPIA, and refer to business continuity and disaster recovery plans.
- Consider and document all security measures that you will take if you are required to share in an urgent situation or emergency.
- Put data sharing agreements in place for this type of emergency sharing in advance, where you know the likely sharing partners.
- Train staff on emergency plans and how to share information in these situations.
Options to consider:
- Run tests or simulations to check that plans and training are adequate and effective.
- Document the risks of not sharing in these situations.