Multi-Agency Safeguarding Hub (MASH) adults

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Paul Bond. You can contact him at or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

The Multi-Agency Safeguarding Hub (MASH) service was established in 2013 and is the single point of access in Lancashire for all safeguarding concerns across all service areas for adults with care and support needs aged 18 years and over. The MASH consists of representatives from the county council's adult safeguarding and children's social care departments working alongside the police, health, Lancashire fire and rescue, probation and other partners.

Social workers within the MASH service undertake an Initial statutory (Care Act 2014) Section 42 safeguarding enquiry on each safeguarding alert. This includes information gathering, risk assessing and analysis, decision making including strategy discussions and the development of a Safeguarding Plan in conjunction with the person and/or their representative/advocate and partners within MASH.

All decisions around the response to a safeguarding concern are made in conjunction with the individuals concerned, or their representative/advocate, and with partnership agencies where possible and appropriate.

The MASH service will only collect and process/use information for individuals

  • To prevent harm or abuse for Adults who by reason of their care and support needs are unable to protect themselves from either actual or potential abuse or harm.
  • Where appropriate to arrange for the concern/risk to progress along an alternative care pathway – e.g. social care assessment/ carer's assessment / care package increase etc. to minimise the risk of abuse or harm and to promote wellbeing
  • To make contact with the alleged victim (or their representative if appropriate) to obtain informed consent to safeguarding enquiries and to discuss their desired outcomes in line with making safeguarding personal. If consent is declined information will be used to consider if there are valid reasons to act e.g. where others are at risk; need to address a service failure that may affect others
  • To make an initial view regarding mental capacity and as appropriate refer to the appropriate service such as Advocacy Services for alleged victims, who may lack capacity and may require support to participate in the safeguarding enquiry process and the safeguarding planning arrangements.
  • To consult with Police partners within the MASH where there is concern that an alleged victim is the subject of crime – to determine if the police should lead the safeguarding enquiry and to determine if a single agency community visit or police and social worker joint enquiry is needed.
  • To consult with Police partners to obtain police intelligence of the person alleged to have caused harm to determine if there is intelligence which may suggest risk to alleged victim/risk to others /risks to the environment.
  • To share information and discuss with key statutory partners to mitigate against such risks.
  • To work alongside and in partnership with MASH and LCC partners such as the LCC Children's Social Care (CSC) MASH and the Emergency Duty Team (EDT) out of hour's social work service.
  • To notify the CQC the regulator (for regulatory purposes) in respect of all safeguarding alerts received in respect of all allegations for individuals in receipt of registered residential or domiciliary care services for consideration of regulation breach.
  • To notify LCC contracts where there is information and allegations relating to quality concerns and consideration of contractual breach.
  • To consult with registered service providers to enable them to take timely action to mitigate the immediate risk and or prevent a re-occurrence of the safeguarding incident.
  • To obtain assurance that advice and medical intervention as required has been obtained.
  • To work to the categories of abuse as defined in the Care Act 2014 (amended 2016)
  • To record and maintain information on the Radar spreadsheet which contributes to the Radar and QPIP quality meetings so that the overall quality of registered services in Lancashire can improve and contribute to patient safety.
  • To follow the Local authority serious incident reporting procedure where criteria is met (currently being drafted April 2018)
  • Where possible and appropriate make section 42 safeguarding enquiries (Care Act 2014) and reach a conclusion, ensuring that a safeguarding plan is in place. Where an enquiry concludes neglect or an omission of care has occurred within regulated services, make recommendations in respect of actions required to prevent a re-occurrence.
  • Information will only be shared on a need to know basis in accordance with the information sharing agreement and General Data Protection Requirements.
  • To monitor, evaluate and plan for service improvements.

Category of personal data being processed

  1. Personal data (information relating to a living, identifiable individual)
  2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

(d) Vital Interests: the processing is necessary to protect someone's life.

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(g) Processing is necessary for reasons of substantial public interest.

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Supporting legislation:

The Care Act 2014 – The Act sets out a clear legal framework for how local authorities and their partners should protect adults at risk of abuse or neglect which relies heavily on the timely sharing of information in order to providing an effective response where there are emerging concerns.

Children Act 2004 - Sections 10 and 11 of the Children Act 2004 place obligations upon agencies including local authorities, police, clinical commissioning groups and NHS England to co-operate with other partners in promoting the welfare of children and ensuring that they act safeguard and promote the welfare of children in their area.

Children Act 1989 - For children and young people, the nature of the information that will be shared within the MASH may fall below a statutory threshold of Section 47 (children in need of protection) or even Section 17 (children in need of services).

Crime and Disorder Act 1998 - Provides a legal basis for sharing information with a relevant authority where the disclosure is necessary or expedient for the purposes of any provision of the Crime and Disorder Act 1998. Relevant authorities include: Police, Probation, Local Authorities, CCGs and certain NHS statutory bodies.

The Localism Act 2011 gives local authorities the power to do anything that individuals may generally do. Under section 1 of the Act local authorities have the power to do anything which they consider is for the benefit of the authority, its area or persons resident or present in its area.

Human Rights Act 1998 - Gives force to the European Convention on Human Rights and, amongst other things, places an obligation on public authorities to protect people’s “right to life” and “right to be free from torture or degrading treatment”. There needs to be a balance between the desire to share and a person’s right to privacy under “the right to respect for private and family life, home and correspondence”. The local authority cannot interfere with this right except such as is necessary in the interests of national security, public safety or for the prevention of disorder or crime, for the protection of health and wellbeing, or for the protection of the rights and freedoms of others.

The Mental Capacity Act 2005 - Under the Mental capacity Act 2005 staff are required to apply five principles in their assessments to decide whether to share information without consent in a person’s best interests. Under the Mental Capacity Act 2005 there would have to be good reasons not to undertake an assessment of mental capacity regarding the decision to share information without consent. These reasons would need to be documented carefully.

Counter-Terrorism and Security Act 2015 - The Counter Terrorism and Security Act 2015 places a duty on “specified authorities” to have “due regard to the need to prevent people from being drawn into terrorism”. Specified authorities include County and District/Borough Councils, Schools; Police; National Probation Service and Community Rehabilitation Companies; NHS Trusts and NHS Foundation Trusts.

Recipients of the data

  • Lancashire County Council Children's Social Care, Youth Offending Team, Education, Wellbeing, Prevention and Early Help Service
  • Lancashire Constabulary
  • Lancashire Fire and Rescue
  • Lancashire Victim Support
  • Lancashire Probation Service
  • The Cumbria And Lancashire Community Rehabilitation Company Limited
  • Blackpool Teaching Hospitals NHS Foundation Trust
  • Lancashire Teaching Hospitals NHS Foundation Trust
  • NHS East Lancashire Clinical Commissioning Group
  • NHS Chorley and South Ribble Clinical Commissioning Group
  • NHS Fylde and Wyre Clinical Commissioning Group
  • NHS Greater Preston Clinical Commissioning Group
  • NHS West Lancashire Clinical Commissioning Group
  • NHS Morecambe Bay Clinical Commissioning Group
  • NHS Midlands and Lancashire Clinical Support Group
  • East Lancashire Hospitals NHS Trust
  • Care Quality Commission
  • Virgin Care Services Ltd

Information we share

The Care Act 2014 stipulates that safeguarding duties apply to an adult who;

  • Has care and support needs (whether or not the Local Authority is meeting any of those needs) and
  • Is experiencing, or at risk of, abuse or neglect and
  • As a result of care and support needs, is unable to protect themselves from either the risk or experience of abuse or neglect

MASH collects and holds information about people for whom this safeguarding duty applies. This information is only shared between MASH partner agencies where relevant and on a need to know basis and in response to allegations or likelihood of abuse and/or harm

  • name
  • date of birth
  • address
  • medical information
  • category of need
  • details of placements
  • safeguarding concerns
  • risk assessments
  • social services number
  • NHS number
  • assessment information
  • carer/family information
  • person alleged to have caused harm details
  • other agency involvement

This may include making referrals to various organisations to contribute to a safeguarding plan and/or as part of an assessment/review.

Any transfers to another country

  • No

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type Description Retention period
Children's Safeguarding / Child Protection Service User File Case files relating to the safeguarding provisions put in place. 75 years from the date of birth.
Children who have had advice and support but did not lead to registration (Non Statutory work)- this could include Initial Assessment up to S47 but were not made subject to a Child Protection Plan 20 years from closure
Schedule 1 Offenders Records on persons cautioned or convicted of an offence under Schedule 1 of the Children and Young Persons Act 1933 100 years from the creation of the record
Children's Mental Health Records of those Children who have been detained under Section 2 or 3 of the Mental Health Act 1983 or those with a 'severe and enduring mental illness' 20 years after no further treatment considered necessary or 8 years after the service users death if the service user died while still receiving treatment
Adult Safeguarding Records relating to safeguarding concerns relating to adult service users 10 years from when the safeguarding case was closed
Adult Social Care Records relating to people who are elderly, physically disabled, have a learning disability or social inclusion needs 3 years from the death of the service user or the case is closed

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall


To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific project then please contact

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email:

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).