Privacy notice (parents & children)

What you need to know

The plain-English guidance that comes with this document.

• You hold children's data — the most sensitive kind — so this matters a lot. Health, development, safeguarding and family information about young children is special-category, high-risk personal data. UK GDPR requires you to tell parents, in plain language, what you hold and why. Give this at enrolment alongside the registration form.
• Be clear that safeguarding overrides consent. Parents should understand up front that if you believe a child is at risk, you will share information with the right agencies without their consent — that's not a breach, it's your duty. Saying so plainly here avoids a difficult conversation later and is honest.
• You're the data controller. Even a childminder working alone is a controller and must comply. That's why this carries your name and address.
• Photos and apps need care and consent. Learning-journey photos, and any nursery app you use, involve children's images and data — get specific consent, keep it secure, and never post children on public social media without clear, separate permission.
• Retention isn't "keep forever" or "bin at once". Some records (safeguarding, accidents) have long required retention periods; others should go once the child leaves. Know which is which, and dispose securely.
• Professionally structured starting point — adapt and sign off. A manager tailors retention periods and sharing to your setting, the current EYFS and your local safeguarding partnership; it's not "compliant out of the box". England-led — check your nation's requirements.