The Multi-Agency Safeguarding Hub (MASH) gathers multi-agency information to make assessments and decisions, ensuring the most appropriate intervention based on the child's needs. MASH provides triage and multi-agency assessment of concerns for vulnerable children, bringing together professionals from various agencies into an integrated team.
The purpose of a MASH includes a more coordinated response to concerns, an improved journey for the child, and a greater emphasis on early help. This leads to better-informed services and timely interventions. There is close partnership working, clear accountability, and improved multi-agency communications. Additionally, there is a reduction in inappropriate referrals and re-referrals.
The benefits to agencies include collective safeguarding of vulnerable children and avoiding duplication of work.
How do we use your personal data?
If a safeguarding concern for a child, adult or victim is identified partners will use and share information between professionals to protect vulnerable children and adults from harm, neglect and abuse.
Types of personal data
The types of personal data we process include, but are not limited to:
General categories
- Immediate personal information, full name
- Date of birth
- Gender
- Address
- Telephone number
- Ethnicity
- First Language
- Education and School records where relevant to any safeguarding and wellbeing concerns raised on children
- Social Care records where relevant to any safeguarding and wellbeing concerns raised on children
- Youth Justice Services records where relevant to any safeguarding and wellbeing concerns raised on children
- Probation Services records where relevant to any safeguarding and wellbeing concerns raised on children
- Health Care records where relevant to any safeguarding and wellbeing concerns raised on children
- Police records where relevant to any safeguarding and wellbeing concerns raised on children
Subcategories
- Parents or carers details (including any relatives and/or persons with legal responsibility for children and young people)
- Records considered to be relevant to any safeguarding and wellbeing concerns raised on children
- The child's needs and circumstances
- Professional opinions
- Information that the child's carer/other people they know have given to us
- Information provided by other services working with the child, for example, Health, Education, Police
- Care workers and voluntary agencies
- Information about the results of any care proceedings as decided by the Court
- Education information including vulnerable Characteristics, for example, Children Looked After (CLA), Additional/Special Learning Needs, Free School Meals (FSM), Asylum Seekers, Travellers, English/Welsh as an Additional Language (EAL), Service Children, Young Carers, etc.
- Information about employment and criminal investigations where relevant to the safeguarding duty being discharged
- Information that your carer or other people that know you have given us
How we use your data
Your data is used to evaluate whether children are eligible for social care services and which services they should receive. We also use information to help us plan, organise and improve those services, report on the work we have done and show we have used public funds properly. Where possible information used for these purposes is made anonymous.
We make sure all personal information is held securely and only made available to those who need to use it. We do not keep personal information longer than we need to.
Children's Services uses the information to ensure the safeguarding and well-being of the children within Cardiff Council. We will use this information to make sure that:
- staff supporting the child have accurate, up to date information to help decide the best possible support for them
- there are accurate records when we review their care and support
- any concerns can be properly looked into if you have a complaint
- they only have to give their information once.
How do we obtain your personal data?
We obtain your personal data from sources including:
- Persons making a referral
- Personal data provided by you
- Relatives, guardians or other persons associated with you
- Third sector organisations
- Referrals from the Police
- Healthcare, social and welfare advisors or practitioners
- Probation Service
- Other departments within the Council, including education
What is our lawful basis for processing your personal data?
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Social Services and Well-Being Act (Wales) 2014
Part 7 - strengthens safeguarding responsibilities of organisations in relation to adults and children and the duty to report concerns
Part 9 requires local authorities to promote cooperation with relevant partners in relation to adults' children and carers and specifies arrangements for information sharing.
Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Public Interest Act 1998
An Act to protect individuals who make certain disclosures of information in the public interest, to allow such individuals to bring action in respect of victimisation; and for connected purposes;
Criminal Justice Act 2003
An Act to make provision about criminal justice and about dealing with offenders; to amend the law relating to jury service; to make provision about civil proceedings brought by offenders; and for connected purposes;
Criminal Justice and Court Service Act 2000
An Act to establish a National Probation Service for England and Wales and a Family Court Advisory Service; to make further provision about dealing with persons suspected of, charged with, or convicted of offences;
Section 7 of the Local Authority Social Services Act 1970
This requires local authorities in their social service functions to act under the guidance of the National Assembly for Wales;
Mental Capacity Act 2005
Provides a test for assessing the decision making capacity of adults and children aged 16 and 17, and enables action to be taken and information shared in their best interest;
Section 2 of the Local Government Act 2000
Provides local authorities with powers to promote or improve the social wellbeing of their area. This provides an implied power to share information with other statutory services and the independent sector;
Section 115 of the Crime and Disorder Act 1998
Permits the disclosure of personal information that may otherwise be prohibited to support local crime and disorder strategies in accordance with the objectives specifically outlined within it. There is not a compulsion to disclose and the organisation must make its own decision; however, the requirements of the common law duty of confidence and data protection legislation must still be met. Therefore, information given in confidence must not be disclosed unless there is a clear overriding public interest to do so.
Where it is necessary to share the personal information of children, partner organisations may also rely on the provisions of power provided under the following legislation:
Children Act 2004
Provides the legislative framework for child protection in Wales. Key principles established by the act include: the paramount nature of the child's welfare; the expectations and requirements around duties of care to children. Part 3 of the Act applies solely to Wales;
Safeguarding Vulnerable Groups Act 2006
Established the Independent Safeguarding Authority (ISA) to make decisions about individuals who should be barred from working with children and maintain a list of these individuals;
Education Act 1996
Under section 14 of the Education Act 1996 (EA 1996) local authorities are under a duty to ensure that there are sufficient primary and secondary schools in their area to provide all pupils with the opportunity of an appropriate education.
Section 175 of the Education Act 2002
In Wales, schools must follow Keeping learners safe: the role of local authorities, governing bodies and proprietors of independent schools under the Education Act 2002 (Welsh Government, 2012). Arrangements for safeguarding children are set out in section 175 of the Education Act 2002
Education Act 2011
Includes a provision requiring school governing bodies, local education authorities and further education institutions to make arrangements to safeguard and promote the welfare of children;
Children and Young Persons Act 2008
Legislates for the recommendations in the Care Matters white paper (DfES, 2007) to provide high quality care and services for children in care.
Welsh Government - In Safe Hands 2000
(Section 7 of the Local Authority Social Services Act 1970, which requires Local Authorities in their social service functions to act under the guidance of the National Assembly for Wales).
When we collect special category data as listed above, we also rely on the following lawful bases:
UK GDPR Art 9(2)(g) requires a basis in UK law, which is provided by Section 10(3) of the Data Protection Act 2018.
This in turn refers to the need to meet a relevant condition in Part 2 of Schedule 1 of the DPA 2018. The relevant condition is:
- Schedule 1, Part 2, Paragraph 7 - Administration of justice and parliamentary purposes:Information may be shared for the purpose of administering justice.
- Schedule 1, Part 2, Paragraph 18 (1) - Safeguarding of children and individuals at risk:the processing is necessary for the purposes of:protecting an individual from neglect or physical, mental or emotional harm, or protecting the physical, mental or emotional well-being of an individual.
Who we share information with
The organisation providing you with this notice and controlling the information supplied is the Multi Agency Safeguarding Hub (MASH), which consists of:
- Cardiff Council (Adult Services, Childrens Services, Youth Justice Service, Education, Housing and Communities)
- South Wales Police (SWP)
- Cardiff and Vale University Health Board
- His Majesty's Prison and Probation Services - HMPPS
Third sector providers are virtually involved in the MASH process to provide support to domestic abuse victims in line with the multi-agency referral assessment conferencing (MARAC).
Why we share information
Personal information is being shared in order to:
- Respond to safeguarding concerns or care and support needs
- Compliance with legal and statutory obligations for safeguarding
All participating Agencies within the MASH process personal information, which relates to you or members of your family's; safety, wellbeing and protection from harm, neglect and abuse.
All members of staff employed by these agencies are bound by the common law duty of confidentiality which means that information that you provide to us must be held in confidence and not shared with anyone else unless:
- Partners are legally obliged or permitted to disclose the information to another organisation or person.
- Protocols are in place permitting partners to share information about you/your family to support any intervention or services provided.
Reasonable steps to meet the service user's communication needs must be taken. These needs should be shared between partners as part of integrated, local information sharing processes/protocols.
Data retention
Your data is retained for the following period of time, depending on intervention type:
| Intervention type | Time period |
|---|---|
| Child Protection (Section 47 or CP Registration) | 35 years from closure |
| Children Looked After | 75 years from 18th birthday |
| Adopted Children | 100 years |
| Children subject to a wellbeing assessment (no further action) | 5 years from closure |
| Children subject to a wellbeing assessment (ongoing work) | 7 years from closure |
| Children subject to a family help assessment (no ongoing work) | 5 years from closure |
| Children subject to a family help assessment (ongoing work) | 7 years from closure |
Your data protection rights
Under data protection law, you have rights including:
Your right of access
You have the right to ask us for copies of your personal information.
Your right to rectification
You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing
You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing
You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability
You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have 1 month to respond to you.
Please contact us at [email protected] if you wish to make a request, or complete the Individual Rights Form.
If you have a concern about a child at risk of harm, please contact the MASH on 02920 536490.
If you have a concern about an adult at risk of harm, please contact the MASH on 02920 338439.
In an emergency outside of the hours of 8:30am to 5pm Monday to Thursday, or 8:30am to 4:30pm on a Friday, please call the Emergency Duty Team on 029 20 788570.
If you think someone is in immediate risk for a child or adult, please contact the police on 999.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at [email protected].
You can also complain to the ICO if you are unhappy with how we have used your data:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Contacting Data Protection
Please contact the Data Protection Officer for further information.
Data Protection Officer
Information Governance Team
County Hall
Atlantic Wharf
CardiffCF10 4UW
Email: [email protected]
This privacy notice was last updated on 9 June 2025.
