Sharing pupil allergy information: New guidance for schools ahead of Benedict’s Law

With Benedict’s Law coming into force this September, schools across the country are preparing for new safeguarding responsibilities while ensuring compliance with data protection legislation. However, an overly cautious approach to GDPR could unintentionally place pupils at greater risk.

To support the schools ahead of new academic year, Anaphylaxis UK and Data Protection Education have published a 3-page practical guide on safely sharing pupil allergy information. The guidance introduces the Secure Safe Care Information Point (SSCIP) – a designated and controlled location for storing and accessing essential medical information.

The resource provides schools with clear, practical advice on when and how sharing pupil allergy information can be done lawfully. It includes a role-based information-sharing matrix outlining what information should be available to catering staff, supply teachers, lunchtime supervisors and emergency responders, together with the lawful basis for each disclosure.

The guide also challenges one of the most common misconceptions surrounding school health data. It explains that parental consent is not the legal basis for processing pupil health information under UK data protection law. Instead, it outlines the appropriate legal grounds for processing and sharing information to protect children’s health and safety.

In addition, the publication offers practical recommendations for maintaining accurate allergy information in emergency grab bags and educational visit packs. It ensures critical medical details remain available wherever pupils are being cared for.

The guide concludes with a September 2026 compliance checklist, helping schools review their policies and procedures.

The guidance is available to download free of charge.