That sounds fab. Yes, if you are giving the info to the person GDPR is fine, if they have given you permission to share directly with a college my understanding is you can do, what the college then do with this if they are not going to them is up to the college (we tack back and check this post enrolment).
It would be great to triangulate what support school have considered required for an incoming student, what they student feel they should have had and what the parents want them to have had as often we find these three things are not the same, as I am sure you do 😊
Have you ever used Microsoft forms? If your school is a Microsoft organisation this may be an easy way to collect all the info you need.