1. Purpose and scope

This policy applies to Association members, trainees, trainers, supervisors and anyone handling client material within Association activities. It covers spoken, written, recorded, visual and electronic information obtained through practice, training, supervision, complaints, safeguarding or professional support.

Practitioners must also follow the law, professional duties, employer procedures and insurance conditions that apply in the country and setting where they work. This policy does not create an automatic legal duty to disclose every concern.

2. Explain the limits before work begins

Clients should be told, in plain language, how confidentiality works and the limited circumstances in which information may be shared without permission. This should form part of contracting and informed consent. Do not promise secrecy that cannot lawfully or safely be maintained.

3. Grounds that may justify disclosure

• Immediate or serious risk: credible information indicates a serious risk of death or significant harm to the client or another person, and disclosure is necessary to reduce that risk.
• Safeguarding: information is needed to protect a child or an adult at risk from abuse, neglect or exploitation. Follow the Safeguarding Policy and the relevant local route.
• Legal compulsion: disclosure is required by legislation, a valid court order or another binding legal process. Confirm the authority and scope before disclosing where time permits.
• Vital emergency: the person is unable to give consent and limited information is essential to protect life or obtain urgent care.

4. Decision process

1. Address immediate danger. Contact emergency, police, medical or safeguarding services in the person’s location when delay may expose someone to serious harm.
2. Clarify the facts. Distinguish what was seen or said from assumption, interpretation or hearsay.
3. Consider consent. Ask for permission unless doing so is unsafe, impracticable, legally prohibited or likely to frustrate protective action.
4. Identify authority and purpose. Record the lawful, ethical or safeguarding reason for the disclosure and why it is necessary.
5. Seek advice. Where time permits, consult the Association safeguarding lead, a supervisor, insurer, employer, legal adviser or relevant authority. Use anonymised information where practicable.
6. Share the minimum necessary. Disclose only relevant information, to an appropriate person or body, through a secure route.
7. Record and review. Make a factual, contemporaneous record of the decision, advice, information shared, recipient and follow-up.

5. Informing the client

Tell the client what will be or has been disclosed, to whom and why, unless this would increase risk, prejudice an investigation, breach a legal restriction or expose another person. Record the reason if the client is not informed. A client’s objection should be taken seriously, but it does not prevent a disclosure that is necessary and lawful.

6. Supervision, training and case discussion

Use anonymised, altered or generalised material wherever possible. Names alone are not the only identifiers: locations, occupations, rare events, images, dates and combinations of details may identify a person. Identifiable recordings, transcripts, messages or case files must not be shared with peers, trainers or supervisors without express written permission or another clear and documented lawful basis.

7. Data protection

A disclosure must comply with applicable data-protection law as well as the duty of confidence. UK practitioners must identify an Article 6 lawful basis and, for health or other special-category data, an Article 9 condition before processing. Consent is not the only possible lawful basis, but emergency or safeguarding language must not be used as a shortcut when the legal threshold is not met.

8. After a disclosure

• continue only within competence and do not obstruct statutory or clinical action;
• preserve relevant records securely and do not retrospectively alter notes;
• follow the Duty of Candour Policy where an error or omission has occurred;
• report a related incident through the Adverse-Event Reporting Policy where appropriate; and
• review what can be learned without disclosing unnecessary personal information.

9. Concerns about a decision

A client or other concerned person may use the complaints and feedback route. A suspected personal-data breach should be handled under the Data Protection and Online Privacy Policy. Association review does not replace a report to the ICO, police, safeguarding authority, employer, insurer or regulator where another route is required.