Sharing Personal Data in an Emergency: What Responders May Do

If a flood is rising, a power cut has gone on for days, or a fire is forcing your block to evacuate, the organisations helping you will need to know who in the household depends on electricity for medical equipment, who cannot use stairs, and who has no one nearby to check on them. That information is personal data, and many people assume the law blocks it from being passed around. In a serious emergency the opposite is true. Official government guidance for emergency planners and responders in England states plainly that where there is a risk of serious harm to human life, it should be assumed that it is lawful to share personal data if it is necessary to respond to that emergency¹.

The regulator that enforces data protection law, the Information Commissioner's Office, gives responders the same message. Its advice, quoted in that government guidance, is: "In an emergency you should go ahead and share data as is necessary and proportionate."¹. The legal footing is Article 6(1)(d) of the UK General Data Protection Regulation, which allows sharing where it is necessary to protect the vital interests, meaning life and safety, of individuals, and paragraph 30 of Schedule 1 to the Data Protection Act 2018, which covers special category data such as health information¹. In other words, the law is built to let responders act first and worry about paperwork later when lives are at stake.

This page explains what that means in practice for an ordinary household: when sharing can be assumed lawful, how the priority services registers run by utilities pass your details to responders, what you should tell suppliers and responders in advance, what the Emergency Alerts service on your phone does and does not collect, and where to turn if you are unhappy with how your data has been handled. If you are looking for broader help because someone in your home is older, disabled or medically dependent, see Extra Help in an Emergency.

When sharing your data is lawful without your consent

The starting point in everyday life is that organisations need a reason, and often your consent, to share personal data. Emergencies change that. The government's supporting guidance for Local Resilience Forums in England, published 28 April 2025, sets out the position: in a serious emergency, for example where there is a risk of serious harm to human life, it should be assumed that it is lawful to share personal data if it is necessary to do so to respond to that emergency¹. This is not a loophole responders have to squeeze through. It is the designed behaviour of the law.

Two legal provisions do the work. Article 6(1)(d) UK GDPR provides a lawful basis for sharing personal data where it is necessary to protect the vital interests of individuals, and the guidance gives life and safety as examples of what that means. Paragraph 30 of Schedule 1 to the Data Protection Act 2018 goes further and provides a lawful basis for sharing special category data, such as health data, in those circumstances¹. That matters because the most useful information in an emergency is often exactly the sensitive kind: who is on oxygen, who has dementia, who cannot leave the house unaided.

The Information Commissioner's Office, the independent regulator that enforces UK data protection law, has told responders not to hesitate. Its advice is quoted directly in the government guidance:

Two limits sit alongside that permission. The sharing must be necessary, and it must be proportionate. A responder who needs to know which residents on a street rely on home dialysis to prioritise door-knocks can share that; the same responder should not hand out full medical files to anyone who asks. The government guidance frames the test around responding to the emergency in front of them¹. For households, the practical effect is that in the worst hours of a flood, storm or prolonged power cut, the question "may they share this?" is answered yes, and the real safeguards are proportionality and security rather than consent.

The legal basis in everyday situations: consent, public task and your rights

Outside a serious emergency, the ordinary rules of data protection apply, and they shape the everyday ways your details move between councils, fire services and health bodies. Most of these routes rest on consent or on a public task rather than on vital interests, and it is worth knowing which is which, because it determines what you control.

Fire and rescue services state their lawful basis openly. Devon and Somerset Fire and Rescue Service, for home safety visit information, gives the basis as "necessary to perform a task in the public interest"⁷. Cheshire Fire and Rescue Service says it takes its responsibilities under the General Data Protection Regulations 2018 very seriously, and explains that it may offer assistance from other agencies such as councils, health services, adult and children's services or third sector organisations, usually explaining this and letting people say no, but not asking for agreement where the law requires contact, which usually relates to crime or serious risk to personal safety¹³. That last clause is the everyday echo of the emergency rule: where someone's safety is seriously at risk, the service may pass information on without waiting for permission.

You keep rights throughout. Derbyshire County Council, for its carer's emergency card scheme, states that under the Data Protection Act 2018 you have the right to access information it holds about you¹⁰. Community-level schemes are told to follow the same principles: a community flood plan should comply with GDPR regulations when gathering personal information from people¹¹, and guidance for flood wardens says to maintain a simple, GDPR aware list of residents who may need help, with consent, minimal personal data and secure storage, and notes the parish council can help¹². NHS bodies carry the same duties: an NHS lessons-learned review notes trusts are responsible for protecting the data they hold under data protection law, and for having arrangements in place to respond to an incident or emergency under the Civil Contingencies Act 2004¹⁴.

When responders can assume sharing is lawful, and when they must ask

The boundary between "share first" and "ask first" is the boundary between a serious emergency and everything else, and responders are encouraged to settle it in advance rather than argue it at 3am. The government guidance for Local Resilience Forums says Category 1 and 2 responders, meaning the emergency services, local authorities, health bodies and utilities, are strongly encouraged to have pre-agreed Data Sharing Agreements between the responding agencies of the forum¹. Those agreements exist precisely so that in a serious emergency nobody has to pause to check whether a disclosure is permitted.

Health and social care bodies are given the same instruction for cold weather, one of the most common UK emergencies. Guidance for healthcare professionals, updated 24 September 2025, says managers should ensure data sharing agreements or protocols are in place to allow organisations to share data or intelligence, including details of the most vulnerable people where appropriate¹⁵. Parallel guidance for adult social care managers says the same, and applies all year round, not only in winter¹⁶.

The clearest example of "ask first" is the residential personal emergency evacuation plan, or RPEEP, used for people in flats and other buildings who would need help to evacuate. North Yorkshire Fire and Rescue Service states the Responsible Person must share a small amount of essential information with the fire and rescue service, but only if the resident gives explicit consent⁸. Cornwall Council, in guidance dated 23 March 2026, spells out what may be shared with the fire service when a resident consents: the resident's flat number, the floor the flat is on, a basic indication of whether assistance may be needed, and whether an emergency evacuation statement is in place⁹. It is equally clear about the limit: "No medical details or personal background information should be shared." The information must be kept secure and available to firefighters during an incident, usually in the building's secure information box⁹.

A government consultation on personal emergency evacuation plans, with its response published 2 December 2024, shows how seriously this is taken. Twenty-two responses addressed the issue of information sharing, including digital information, and five responses raised GDPR issues, with comments suggesting consideration be given to the security of private information stored within information boxes¹⁷. The security of the box that holds your evacuation details is treated as part of the data protection question, not an afterthought.

Behind all of this sits the Civil Contingencies Act 2004. A review of Storm Arwen by Durham County Council, published 13 July 2022, records that under the Act various agencies including the emergency services, utilities and local authorities are under a duty to cooperate and are required to maintain plans to prevent emergencies and reduce, control and mitigate their effects². The same review states that distribution network operators, the companies that run the electricity wires, are required under the Act to liaise with local authorities, strategic coordinating groups and third parties such as the British Red Cross to share information about vulnerable customers². You can read more about these duties in The Civil Contingencies Act 2004: What It Requires and Category 1 and Category 2 Responders: Who They Are.

How priority services registers pass your details to responders

The Priority Services Register is the main route by which your details reach responders before an emergency, and it works by design rather than by accident. It is run by your energy supplier, your electricity network operator and your water company, and the government's easy-read guidance for disabled people and carers lists who is behind the registers: the local council, the water company, and the gas and electricity company¹⁸.

The mechanics are straightforward. Derbyshire County Council's guidance on the register explains that your supplier can pass details to your network operator to add you to their register as well, and that this is a good idea especially if you rely on your energy for medical reasons¹⁹. So one sign-up can place you on two registers: the supplier you pay, and the company that physically maintains the wires or pipes to your home. The help that follows is practical: the register can mean sending someone to check your meter regularly, and eligibility includes households with extra communication needs¹⁹.

What matters in an emergency is where the register goes next. Dorset Prepared, the county's official resilience partnership, states that if there is a wider interruption in supply, your information could help to direct an emergency response to people who are most vulnerable³. That is the point of the system: during a prolonged power cut or water failure, the network operator can hand responders a list of the households to check first. The UK Government Resilience Framework 2023 implementation update, published 4 December 2023, records that the majority of water companies and gas and electricity distribution network operators now share their Priority Services Register in this way⁴. The Storm Arwen review confirms the legal spine: network operators are required under the Civil Contingencies Act 2004 to liaise with local authorities, strategic coordinating groups and third parties such as the British Red Cross to share information about vulnerable customers².

If someone in your household is older, disabled or medically dependent, registering is one of the highest-value steps you can take, and it costs nothing but a phone call to your supplier. Full details of eligibility and the help available are on Extra Help in an Emergency, and the wider context of power cuts is covered in Power Cuts: A Household Guide.

What vulnerable households should tell responders and suppliers

The data that helps you in an emergency is data you supplied in advance, and official advice across the UK is consistent about what to prepare. The core is a household plan with contacts. The London Resilience Partnership advises making a household plan containing emergency contact details for your family or the people you live with, as well as details relating to your insurance and utility providers²¹. North Devon Council says to write down important phone numbers, including your utility suppliers and people you may need to contact²², and Nottinghamshire County Council includes in its household emergency plan the contact details of family members you will need to inform and your local doctor's number²³. Belfast City Council points to a household emergency life-saving plan that gives you a list of useful contact numbers in an emergency and tells you what you should have in your household emergency pack²⁴.

A checklist of what to have ready:

• Emergency contacts in your phone: set up emergency contacts in your mobile phone and add your medical information if possible, as independent consumer guidance from Which? advises²⁵. This is the "Emergency Sharing" feature many phones carry, and it puts your chosen contacts and medical details where a responder can find them from the lock screen.
• A written contact list: family, your doctor, utility suppliers and insurers, on paper, because a power cut or a lost phone removes the digital copy²¹.
• Your suppliers' priority register status: confirm you are on the Priority Services Register with your supplier, and ask them to pass details to the network operator if you rely on energy for medical reasons¹⁹.
• An evacuation plan if you would need help to leave: a residential personal emergency evacuation plan, created and shared only with your consent⁸.
• Neighbours who know you: swap contact details with neighbours and ask friends, family or colleagues whether they need additional support in an emergency²⁵.

For people who would need help to evacuate a building, the RPEEP process is consent-based at every step. London Fire Brigade's guide for residents states that you do not have to get an RPEEP, and one can only be created and shared with your consent, and that your information is handled in line with data protection law²⁶. NHS Highland, for its winter contingency planning, is explicit about what signing up means: "By providing information for your contingency plan you are agreeing to the information being shared with and used by people working in health and social care services to help them, to help you."²⁷

Communities are encouraged to plan the same way. The Scottish Government's community emergency planning guide, published March 2026, advises groups to think about how they could share local knowledge of vulnerable people with the emergency responders if an emergency happens, because responders cannot always know straight away what people need or who in the community might be vulnerable²⁸. Argyll and Bute Council adds a note of realism about security: keep personal details of volunteers safe and available, remembering you could lose power and access, and only share them with those who need the information²⁹. Flood warden guidance makes the same point about resident lists: consent, minimal personal data and secure storage¹².

*A paper contact list works when the power is off and the phone is flat, and it tells responders who needs to be told about you.]

Looking out for others is part of the same picture. Warwickshire County Council advises finding out whether any elderly or vulnerable neighbours might need your help³⁰, and the Scottish Fire and Rescue Service, in its wildfire prevention advice, says to make sure everyone in your household knows the escape route and meeting place, and to see whether elderly or vulnerable neighbours might need assistance⁶. Warwick District Council adds a specific link to alerts: it advises identifying vulnerable people living nearby who you can inform of the service⁵. For the wider picture of neighbours and local groups, see Community Resilience: A Guide for Neighbours and Local Groups.

Emergency Alerts and your phone: what is shared and what is not

The UK's Emergency Alerts service is the most visible example of emergency data handling, and the official position is that it collects nothing personal at all. Warwick District Council states that Emergency Alerts require no personal information, such as telephone number, identity or location, and that alerts are sent to compatible 4G and 5G mobile phones within an area of risk, with only the government and emergency services able to send them⁵. Croydon Council states the same in its own words: the system does not need your phone number, does not collect personal information or track your location, and no personal data is shared when an alert is sent³¹. Denbighshire Council, covering Wales, puts it simply: "They don't track your location, need your phone number, or collect personal data."³²

The national Be Ready campaign confirms that the organisations sending alerts do not need to know your phone number or location to send you one³³. This works because the system broadcasts to every compatible phone in a defined area, rather than messaging a list of individuals. There is nothing to opt into and no register of who received what.

Two points are worth acting on. First, the government warns that the Emergency Alerts service will never send you emails or ever ask you to provide personal details³⁴. Any message claiming to be an alert that asks for your details is not from the service, and you should treat it as a scam, a risk covered further in Cyber Attacks and Major IT Failures: A Household Guide. Second, if you do not have a compatible device, you will still be informed about an emergency: the government states the emergency services have other means of warning people³⁴. Denbighshire Council also notes it is possible to opt out of the system if you need your phone to stay concealed, advice aimed at domestic abuse victims³².

The separate "Emergency Sharing" or emergency information feature on your phone, where you add contacts and medical details for responders to find, is under your control entirely. Which? advises setting up emergency contacts in your mobile phone and adding your medical information if possible²⁵. Nothing leaves your phone until someone picks it up in an emergency and looks for it. For staying informed more broadly, see Staying Informed and in Touch in an Emergency: A Household Guide.

Where to get help or raise a concern about your data

If you want to know what an organisation holds about you, start by asking it directly. Under the Data Protection Act 2018 you have the right to access information held about you, as Derbyshire County Council states for its carer's emergency card scheme¹⁰. Fire services publish privacy statements setting out their basis for processing: Devon and Somerset Fire and Rescue Service gives "necessary to perform a task in the public interest" for home safety visit data⁷, and Cheshire Fire and Rescue Service explains when it will and will not seek your agreement before involving other agencies¹³.

Where you feel data has been mishandled, the underlying risk is real rather than theoretical. Essex Prepared, the county's official resilience site, notes that personal data breaches can lead to identity theft and legal consequences under GDPR³⁵. The NHS WannaCry review of 2018 is the standing illustration of why responders must protect the data they hold even while preparing to share it in emergencies: trusts are responsible for protecting the data they hold under data protection law and for having arrangements in place to respond to an incident or emergency under the Civil Contingencies Act 2004¹⁴. If your concern is about a building's evacuation information, the government's consultation response shows the security of information boxes is an active policy issue, with respondents raising exactly these GDPR concerns¹⁷.

For consent-based schemes, withdrawal is your lever. Cornwall Council states that information must only be shared where the resident has clearly agreed, that consent can be withdrawn at any time, and that all personal information must be handled in line with data protection law⁹. It also confirms participation is voluntary: you cannot be forced to have an RPEEP, and your information cannot be shared without your consent⁹. London Fire Brigade's guide says the same²⁶. In a serious emergency, of course, the vital interests basis may apply regardless, which is the balance the law strikes between your control and your safety.

The Civil Contingencies Act review and what may change

The duties described on this page are being looked at again. A public call for views on the Civil Contingencies Act was launched in 2026 as part of the Act's post-implementation review, which is due to report in March 2027. The Act's existing requirements continue to apply while that review runs: under the Civil Contingencies Act 2004, various agencies including the emergency services, utilities and local authorities are under a duty to cooperate and are required to maintain plans to prevent emergencies and reduce, control and mitigate their effects². Distribution network operators remain required to liaise with local authorities, strategic coordinating groups and third parties such as the British Red Cross to share information about vulnerable customers².

For households, nothing in the review changes what to do now. The practical steps stand on their own: register with your supplier's priority services if eligible, keep a written contact list, set up emergency contacts on your phone, and give explicit consent, or withhold it, for any evacuation plan. The law already assumes that when life is at risk, your data will be shared to protect you, and the review is about how well the machinery works, not whether it exists. The wider framework is explained in The UK Government Resilience Framework and Action Plan and How the UK Prepares for Emergencies: A Household Guide.