Latest updates - 1 March 2024
1 March 2024 - this guidance was published
About this guidance
Data protection law allows organisations to share personal information in an urgent or emergency situation, including to help them prevent loss of life or serious physical, emotional or mental harm.
This guidance is aimed at giving employers greater certainty about sharing information about their workers in the event of a mental health emergency. It provides advice on when and how it is appropriate to share workers’ information in such an emergency, even if you haven’t thought about this before.
It is good practice to plan ahead, as this will help you make timely and better informed decisions if you need to. So this guidance also provides advice on how to think in advance about sharing workers’ information in a mental health emergency.
It answers the following questions:
- What is a mental health emergency?
- Is mental health information different to health information under data protection law?
- Can we share workers’ information in a mental health emergency?
- How can we plan for information sharing in a mental health emergency?
- What lawful basis and special category condition is most likely to apply?
For more general guidance on processing workers’ health information, see our detailed guidance Information about workers' health.
When we use the terms ‘worker’ we mean all employment relationships, whether this includes employees, contractors, volunteers or gig and platform workers.
To help you understand the law and good practice as clearly as possible, this guidance says what organisations must, should, and could do to comply.
Legislative requirements
Must refers to legislative requirements.
Good practice
Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. You should do this unless there is a good reason not to. If you choose to take a different approach, you must be able to demonstrate that this approach also complies with the law.
Could refers to an option or example that you could consider to help you to comply effectively. There are likely to be various other ways you could comply.
What is a mental health emergency?
You may find a mental health emergency (or a mental health crisis) more difficult to recognise than a person’s physical health emergency. Symptoms of mental health emergencies can vary from person to person and it can be difficult to judge when a situation becomes an emergency.
For the purposes of this guidance, we define a mental health emergency as a situation in which you believe that someone is at risk of serious harm to themselves, or others, because of their mental health. This can include the potential loss of life.
For further information and support for you and your workers, you may wish to contact sources of expertise such as the NHS, your Employee Assistance Programme (if you have one), Mind (in England and Wales), the Scottish Association for Mental Health or Minding Your Head (in Northern Ireland). See other resources below.
Further reading
There may be other circumstances where you are faced with an urgent situation or a more general health emergency which does not meet this definition. For example where risk of serious harm is not present but there is still a need to act with urgency. We have produced other guidance which gives advice on the sharing of personal information in such circumstances:
Is mental health information different to health information under data protection law?
No, data protection law does not distinguish between them, and the definition of health information covers physical or mental health information. The same obligations apply to processing information about your workers’ mental health as their physical health.
Can we share workers’ information in a mental health emergency?
Yes. During a mental health emergency where there is risk of serious harm to the worker or to others you should share necessary and proportionate information without delay with relevant and appropriate emergency services or health professionals.
You should focus on sharing information with the right people to protect the person involved or others from serious harm – even if you have not planned ahead.
You will not get in trouble for sharing necessary and proportionate information with relevant and appropriate emergency services or health professionals that can help mitigate the risk of serious harm to the worker or to others.
You could also share necessary and proportionate information with a worker’s next of kin or emergency contact.
In many situations, people listed in your employee records as next of kin or emergency contacts are essential in providing support to a person at risk of harming themselves or others.
However, you will not necessarily always know the exact nature of the relationship with the next of kin or emergency contact. Depending on the nature of the mental health emergency, and the relationship with that next of kin or emergency contact, it might be inappropriate to share all the information you have with them.
You need to use your judgement in each specific situation, sharing only what is necessary and proportionate to the circumstances. You may decide that, whilst it may be necessary and proportionate to provide the emergency services with a full account of the situation, it is only appropriate to provide their emergency contact with more limited details.
You should also consider whether your ability to share health information is subject to other legal constraints outside of data protection law. For health information, this may include any duty of confidence that may apply, particularly where workers may expect confidentiality.
Example
A worker tells their manager that they are concerned that their colleague is in the process of self-harming in the workplace, putting themselves at risk of serious harm. The manager speaks to the worker and sees that they are obviously in serious distress, with clear evidence of serious ongoing self-harm. The manager contacts the emergency services without delay and gives them the full details of the incident.
When they contact the worker’s emergency contact, they tell them that they have serious concerns for the worker’s wellbeing and that they've called the relevant emergency services. They provide details of who these are and how they can get in touch with them to find out more.
How can we plan ahead for information sharing in a mental health emergency?
In a mental health emergency, data protection does not act as a barrier to necessary and proportionate information sharing. In an emergency you should focus on sharing information with the right people to protect the person involved – even if you have not planned ahead.
However, planning ahead can help you make timely decisions when you need to. This can include putting in place internal policies and processes for information sharing in such an emergency, which document the approach you intend to take.
When thinking about your likely response to a mental health emergency, you must identify a lawful basis to share information. As health information is special category data, you must also identify a special category condition. You should make a record of these in any internal policies that you put in place. See What lawful basis and special category condition is most likely to apply? below.
As part of your transparency obligations, you must let your workers know that you may share their information in a health emergency – including a mental health emergency. You must ensure that your workers are aware of any policy you have for sharing personal information in a health emergency, and that it is available to them. You must provide this information to your existing workers as soon as possible; and to new workers within one month of obtaining their information. With a new worker, you could do this when you ask them to identify an emergency contact.
As noted in our Information about workers' health guidance, you should carry out a data protection impact assessment (DPIA) as part of your general processes on the everyday handling of your workers’ health information. As part of that process, you should include the sharing of information in a mental health emergency. However, if you have not carried out a DPIA in advance, this does not stop you sharing information in a mental health emergency.
You should also take the following steps:
- Develop a policy on sharing personal information in a mental health emergency. Think about the types of information you may need to share, who you may need to share it with and how you will share it securely.
- Ensure that your workers are aware of the policy and make it available to them.
- Train staff on how to handle personal information in a mental health emergency situation. If you have designated people who will respond in such situations ensure the rest of your staff know who they are and how to contact them. This could be included within broader training and awareness raising you may have in place around mental health.
- Ensure that workers keep the details of their next of kin and emergency/mental health emergency contacts that you have on file up to date through regular review. You could give your workers the opportunity to identify separate emergency contacts for general emergencies and mental health emergencies on an emergency contact form.
What lawful basis and special category condition are most likely to apply?
When thinking about sharing personal information because of a mental health emergency, you must identify a lawful basis to share information. As health information is special category data, you must also identify a special category condition.
The most appropriate lawful basis and special category condition will vary depending on the situation. We have produced other guidance that explains the lawful bases and special category conditions, which includes a lawful basis interactive toolkit.
The lawful bases that are most likely to apply are:
- Vital interests – this may apply where you need to share a worker’s health information to protect either their life or someone else’s. This is limited in scope and generally only applies in matters of life and death. You cannot use this basis if the worker is capable of giving consent.
Example
A worker tells their manager that they are intending to act on their suicidal thoughts. After speaking with the person, the manager considers that there is clear evidence that there may be a threat to their life. They share that person’s information with the emergency services to enable them to better respond to the needs of that person.
- Legitimate interest – this may apply, unless there’s a good reason for protecting the worker’s personal information which either outweighs your interests or the interests of a third party.
Example
A worker is displaying clear signs that they are experiencing a mental health emergency that is posing a serious risk to themselves and other workers. When the worker’s manager tries to provide support, the worker refuses their help. However, the manager cannot ignore the risk to the worker concerned or the other workers. The manager considers that it is in both the worker’s legitimate interests and their own interests to share the affected person’s information with emergency services so that they can receive the assistance they need and so that others can be protected.
- Legal obligation – you may rely on this basis where you’re required by law to share information in these circumstances. This might be either in statute or in common law, but it does not apply to a contractual obligation. The information sharing must be necessary to comply with the legal obligation and you must do it in a reasonable and proportionate way.
Example
A health and social care provider receives information from one of their service users that one of their workers has experienced a mental health emergency while working a shift. The provider has a legal obligation under the Health and Safety at Work Act 1974 to provide a duty of care towards those people who use its services. The provider contacts the emergency services and shares details of their worker’s information so they can respond appropriately in a way that is safest for both the service user and the worker.
The special category conditions that are most likely to apply are:
- Vital interests – Similar to the vital interests lawful basis discussed above, this condition may apply in circumstances of life and death.
- Employment, social security and social protection law – this is particularly relevant for employers, for example where you are ensuring the health, safety and welfare of workers. For this to apply you must identify the legal obligation or right in question.
Example
A worker displays signs of suffering a mental health emergency whilst operating machinery. Their employer has a duty, under the Health and Safety at Work etc Act 1974, to ensure the health and safety of all their workers as far as is reasonably possible. The employer contacts the emergency services and shares the worker’s information, because it appears that to not do so would endanger their safety, and the safety of other workers.
There are other lawful bases and special category conditions that might apply, depending on the circumstances (for example, the condition for the safeguarding of children and people at risk). For more information on lawful bases and special category conditions for workers’ health information in the employment context, see our guidance Information about workers’ health.
Further useful information
Our data sharing code of practice contains guidance on data sharing in an urgent situation or in an emergency.
Our detailed guidance on special category data gives further advice on the special category conditions.
We have also developed a data sharing page which gives guidance and practical tools on how to share personal information lawfully.
We have also produced guidance on Data protection impact assessments.