Many organisations engage with adults who are in vulnerable situations or at risk of harm by reason of their physical or mental condition or other particular personal characteristics or family or life circumstance (‘at-risk adults’). While not an exhaustive list, this can include individuals suffering from physical or mental conditions (such as cognitive impairment, dementia, acquired brain injury), children with additional needs reaching the age of majority, individuals subject to domestic violence or coercive control, individuals who find themselves homeless, individuals who are subject to f inancial abuse and individuals who have been trafficked.
Every individual has a fundamental right to protection in relation to the processing of their personal data. However, the right to protection of personal data is not an absolute right and must be balanced against other fundamental rights. In the context of safeguarding at-risk adults, organisations who engage with at-risk adults must ensure that they process the personal data of such individuals in line with data protection law. Processing activities include the sharing or dissemination of personal data to a third party. One of the reasons a data controller may not wish to share personal data is due to concerns arising from compliance with data protection law. However, as set out in this guidance, data protection law does not stand in the way of sharing data within the context of adult safeguarding; what data protection law requires is that the sharing is lawful, relevant, necessary and a proportionate measure for the achievement of the objectives of the data controller, such as the safeguarding of at-risk adults.
The purpose of this guidance document is to assist organisations whether large or small, public or private, or part of the voluntary or charitable sector, in their decisionmaking processes when processing the personal data of such individuals, given the many challenges they face.
