1.9 Data Protection / GDPR

Policy statement

The General Data Protection Regulation is an EU Law from May 2018. It requires us to share information with you about data retention after your child has left our setting.

Data we retain about you and your child falls into 3 main categories-

1. Safeguarding and welfare data linked to Ofsted and the Early Years Foundation Stage requirements and the Limited Act.

2. Financial data retained for HMRC purposes.

3. Funding data retained for Local Authority purposes.

We store data about you and your child in paper format, on a memory stick, on the ‘OneDrive’ and on our email account.

We consider our records as confidential based on the sensitivity of information such as employment records. We have record keeping systems in place that meet legal requirements; which means we store and share that information which takes place within the framework of Data Protection Act (1998) and the Human Rights Act (1998).

‘Confidential information is information that is not normally in the public domain or readily available from another source, it should have a degree of sensitivity and value and be subject to a duty of confidence. A duty of confidence arises when one person provides information to another in circumstances where it is reasonable to expect that the information will be held in confidence.'

Information Sharing: Guidance for Practitioners and Managers (DCSF 2008)

In our setting, staff and managers can be said to have a ‘confidential relationship’ with families. It is our intention to respect the privacy of children and their parents and carers, while ensuring that they access high quality early years care and education in our setting. We aim to ensure that all parents and carers can share their information in the confidence that it will only be used to enhance the welfare of their children. We have record keeping systems in place that meet legal requirements.

We recognise that parents have a right to know that the information they share with us will be regarded as confidential, as well as to be informed about the circumstances when, and the reasons why, we are obliged to share information.

We are obliged to share confidential information without authorisation from the person who provided it, or to whom it relates, if it is in the public interest. That is when:

it is to prevent a crime from being committed or to intervene where one may have been, or to prevent harm to a child or adult; or
not sharing it could be worse than the outcome of having shared it.

The decision should never be made as an individual, but with the back-up of the management team. The three critical criteria are:

Where there is evidence that the child is suffering, or is at risk of suffering, significant harm.
Where there is reasonable cause to believe that a child may be suffering, or is at risk of suffering, significant harm.
To prevent significant harm arising to children and young people or adults, including the prevention, detection and prosecution of serious crime.

We work in partnership with local and national agencies to promote the well being of all children.

We recognise that children sometimes move to another early years setting before they go on to school, although many will leave our setting to enter a nursery or reception class.

We prepare children for these transitions and involve parents and the receiving setting or school in this process. We prepare records about a child’s development and learning in the Early Years Foundation Stage in our setting; in order to enable smooth transitions, we share appropriate information with the receiving setting or school at transfer.

Confidential records are shared where there have been child protection concerns according to the process required by our Local Safeguarding Children Board.

The procedure guides this process and determines what information we can and cannot share with a receiving school or setting.

Procedures

All records are the responsibility of our management team who ensure they are kept securely.
All our records are kept in an orderly way in files and filing is kept up-to-date.
Our financial records are kept up-to-date for audit purposes.
We maintain health and safety records; these include risk assessments, details of checks or inspections and guidance etc.
Our Ofsted registration certificate is displayed.
Our Public Liability insurance certificate is displayed.
All our employment and staff records are kept securely and confidentially.

We notify Ofsted of any:

change in the address of our premises;
change to our premises which may affect the space available to us or the quality of childcare we provide;
change to the name and address of our registered provider, or the provider’s contact information;
change to the person managing our provision;
significant event which is likely to affect our suitability to look after children; or
other event as detailed in the Statutory Framework for the Early Years Foundation Stage (DfE 2021).

Our procedure is based on the seven golden rules for information sharing as set out in Information Sharing: Guidance for Practitioners and Managers (DCSF 2008).

1. Remember that the Data Protection Act is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately.

Our policy and procedures on Information Sharing provide guidance to appropriate sharing of information both within the setting, as well as with external agencies.

2. Be open and honest with the person (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so.

In our setting we ensure parents:

receive information about our Information Sharing Policy when starting their child in the setting and that they sign our Famly online Registration Form to say that they understand the circumstances in which information may be shared without their consent. This will only be when it is a matter of safeguarding a child or vulnerable adult;
have information about our Safeguarding Children and Child Protection Policy; and
have information about the other circumstances when information will be shared with external agencies, for example, with regard to any special needs the child may have or transition to school.

3. Seek advice if you are in any doubt, without disclosing the identity of the person where possible.

Our staff discuss concerns about a child routinely in supervision and any actions are recorded in the child’s file.
Our manager routinely seeks advice and support from the chairperson about possible significant harm.
Our Safeguarding Children and Child Protection Policy sets out the duty of all members of our staff to refer concerns to our manager or deputy, as designated person, who will contact children’s social care for advice where they have doubts or are unsure.
Our managers seek advice if they need to share information without consent to disclose.

4. Share with consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base your judgement on the facts of the case.

We base decisions to share information without consent on judgements about the facts of the case and whether it is ‘in the public interest’.
Our guidelines for consent are part of this procedure.
Our manager is conversant with this and she is able to advise staff accordingly.

5. Consider safety and well-being: Base your information sharing decisions on considerations of the safety and well-being of the person and others who may be affected by their actions.

In our setting we:

record concerns and discuss these with our designated person and/or designated officer from the management team for child protection matters;
record decisions made and the reasons why information will be shared and to whom; and
follow the procedures for reporting concerns and record keeping as set out in our Safeguarding Children and Child Protection Policy.

6. Necessary, proportionate, relevant, accurate, timely and secure. Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up to date, is shared in a timely fashion, and is shared securely.

Our Safeguarding Children and Child Protection Policy and Children's Records Policy set out how and where information should be recorded and what information should be shared with another agency when making a referral.

7. Keep a record of your decision and the reasons for it – whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.

Where information is shared, we record the reasons for doing so in the child's file; where it is decided that information is not to be shared that is recorded too.

Consent

When parents choose our setting for their child, they will share information about themselves and their families. This information is regarded as confidential. Parents have a right to be informed that we will see their consent to share information in most cases, as well as the kinds of circumstances when we may not seek their consent, or may override their refusal to give consent. We inform them as follows:

Our policies and procedures set out our responsibility regarding gaining consent to share information and when it may not be sought or overridden.
We may cover this verbally when the child starts or include this in our welcome pack.
Parents sign our Famly online Registration Form at registration to confirm that they understand this.
We ask parents to give written consent to share information about any additional needs their child may have, or to pass on child development summaries to the next provider/school.
We give parents copies of the forms they sign.
We consider the following questions when we need to share:

– Is there legitimate purpose to us sharing the information?

– Does the information enable the person to be identified?

– Is the information confidential?

– If the information is confidential, do we have consent to share?

– Is there a statutory duty or court order requiring us to share the information?

– If consent is refused, or there are good reasons for us not to seek consent, is there sufficient public interest for us to share information?

– If the decision is to share, are we sharing the right information in the right way?

– Have we properly recorded our decision?

Consent must be informed - that is the person giving consent needs to understand why information will be shared, what will be shared, who will see information, the purpose of sharing it and the implications for them of sharing that information.
Consent may be explicit, verbally but preferably in writing, or implicit, implied if the context is such that sharing information is an intrinsic part of our service or it has been explained and agreed at the outset.
We explain our Information Sharing Policy to parents.

Separated parents

Consent to share need only be sought from one parent. Where parents are separated, this would normally be the parent with whom the child resides. Where there is a dispute, we will consider this carefully.
Where the child is looked after, we may also need to consult the Local Authority, as ‘corporate parent’ before information is shared.

All the undertakings above are subject to our paramount commitment, which is to the safety and well-being of the child. Please also see our Safeguarding Children and Child Protection Policy.

Data Relating to the Safeguarding and Welfare requirements of the EYFS

To comply with the Limitation Act 1980, we keep Accident, Injury and First Aid Records and Medication Administration Records using the legal basis of ‘Legal obligation’ until your child is 21 years and 3 months old and insurance requirements.

Attached to Accident, Injury and First Aid Records and Medication Administration Records we also retain Parent – Provider Contracts and Attendance Registers using the legal basis of ‘vital interests’ to provide additional evidence of compliance with the Early Years Foundation Stage.

We keep further data related to Safeguarding and Welfare requirements of the Early Years Foundation Stage and Childcare Register for a ‘reasonable period of time (see EYFS requirement 3.71). ICO advice is that this should be between Ofsted inspections or within the Ofsted inspection cycle which might be between 3 and 8 years.

Information is kept in an electronic format and after the required retention period the documents to be deleted.

We work in partnership, or in tandem, with local and national agencies to promote the well-being of children.
We have procedures, which are in place for the sharing of information about children and families with other agencies. These are set out in our Information Sharing Policy, Safeguarding Children and Child Protection Policy and the Supporting Children with Special Educational Needs Policy.
Information shared by other agencies with us is regarded as third party information. This is also kept in confidence and not shared without consent from that agency.
When working in partnership with staff from other agencies, we make those individuals welcome in our setting and respect their professional roles.
We follow the protocols for working with agencies, for example on child protection.
We ensure that staff from other agencies do not have unsupervised access to the child they are visiting in the setting and do not have access to any other child(ren) during their visit.
Our staff do not casually share information or seek informal advice about any named child/family.
§ When necessary, we consult with and signpost to local and national agencies who offer a wealth of advice and information that help us to develop our understanding of the issues facing us and who can provide support and information for parents. For example, ethnic/cultural organisations, drug/alcohol agencies, welfare rights advisors or organisations promoting childcare and education, or adult education.

Data Relating to the Learning and Development requirements of the Birth to Five

To comply with the Birth to Five, we keep documents relating to your child’s learning and development including photos of your child’s progress, activities and experiences.

We use the legal basis of ‘legal obligation’ when recording your child’s learning, development and progress and ‘legitimate interest’ when taking photos of your child because we believe it is reasonable for us to process this data to provide you with a good quality service.

We keep the information, including photos online / in paper format and will pass it on to you when your child leaves the setting or starts school, whichever comes first.

We use an On -Line learning journey system, you create your own log in and password for this account. Staff accounts are all also password protected.

Transfer of development records for a child moving to another early years setting or school

Using the Early Outcomes (DfE 2013) guidance and our assessment of children's development and learning, the key person will prepare a summary of achievements in the seven areas of learning and development.
The record refers to:
– any additional language spoken by the child and his or her progress in both languages;
– any additional needs that have been identified or addressed by our setting;
– any special needs or disability, whether a CAF was raised in respect of special needs or disability, whether there is a Statement of Special Educational Needs, and the name of the lead professional.
The record contains a summary by the key person and a summary of the parent’s view of the child.
The document may be accompanied by other evidence, such as photos or drawings that the child has made.
When a child transfers to a school, most local authorities provide an assessment summary format or a transition record, which we will follow as applicable.
If there have been any welfare or protection concerns, we place a star on the front of the assessment record.

Transfer of confidential information

The receiving school or setting will need to have a record of any safeguarding or child protection concerns that were raised in our setting and what was done about them.
We will make a summary of the concerns to send to the receiving setting or school, along with the date of the last professional meeting or case conference. Some Local Safeguarding Children Boards will stipulate the forms to be used and provide these for us to use.
Where a CAF has been raised in respect of any welfare concerns, we will pass the name and contact details of the lead professional on to the receiving setting or school.
Where there has been a s47 investigation regarding a child protection concern, we will pass the name and contact details of the child’s social worker on to the receiving setting or school – regardless of the outcome of the investigation.
We post or take the information to the school or setting, ensuring it is addressed to the setting or school’s designated person for child protection and marked as 'confidential’.
We do not pass any other documentation from the child's personal file to the receiving setting or school.

If a child attends another setting, we establish a regular two-way flow of appropriate information with parents and other providers. Where appropriate, we will incorporate comments from other providers, as well as parents and/or carers into the child’s records.

We keep two kinds of records on children attending our setting:

Developmental records

These include observations of children in the setting, photographs, video clips and samples of their work and summary developmental reports.
These are online and can be accessed, and contributed to, by our staff, the child and the child’s parents.

Personal records

These may include the following (as applicable):

Personal details – including the child’s online registration form and any consent forms (now online).
Contractual matters – including a copy of the signed parent contract, the child’s days and times of attendance, a record of the child’s fees, any fee reminders or records of disputes about fees. (Online)
Child’s development, health and well-being – including a summary only of the child’s Birth to Five profile report, a record of discussions about every day matters about the child’s development health and well-bring with the parent.
Early Support – including any additional focussed intervention provided by our setting (e.g. support for behaviour, language or development that needs an Individual Education Plan) and records of any meetings held.
Welfare and child protection concerns – including records of all welfare and protection concerns, and our resulting action, meetings and telephone conversations about the child, a Statement of Special Educational Need and any information regarding a Looked After Child.
Correspondence and Reports – including a copy of the child’s 2-Year-Old Progress Check (as applicable), all letters and emails to and from other agencies and any confidential reports from other agencies.
These confidential records are stored in a lockable file or cabinet, which is always locked when not in use and which our manager keeps secure in a cupboard.
We read any correspondence in relation to a child, note any actions and file it immediately
We ensure that access to children’s files is restricted to those authorised to see them and make entries in them, this being our manager, deputy or designated person for child protection, the child’s key person, or other staff as authorised by our manager and other staff as authorised by me.
We may be required to hand children’s personal files to Ofsted as part of an inspection or investigation process; or to local authority staff conducting a S11 audit, as long as authorisation is seen. We ensure that children’s personal files are not handed over to anyone else to look at.
Parents have access, in accordance with our Client Access to Records Policy, to the files and records of their own children, but do not have access to information about any other child.
Our staff will not discuss personal information given by parents with other members of staff, except where it affects planning for the child's needs. Our staff induction programme includes an awareness of the importance of confidentiality in the role of the key person.
We retain children’s records for three years after they have left the setting; except records that relate to an accident or child protection matter, which are kept until a child reaches the age of 21 years or 24 years respectively. These are kept in a secure place.

Archiving children’s files

When a child leaves our setting, we remove all paper documents from the child’s personal file and place them in a robust envelope, with the child’s name and date of birth on the front and the date they left or scan and save the document with date for it to be destroyed.
We seal this and place it in an archive box, stored in a safe place (i.e. a locked cabinet) for three years. After three years it is destroyed.
Where there was s.47 child protection investigations, we mark the envelope with a star and archive it for 25 years.
We store financial information according to our finance procedures.

Data relating to Local Authority funding forms

We keep documentation including your name, address, national insurance number and tracking data for Local Authority Funding forms using the legal basis of ‘contractual necessity’. This data is held in paper format and we are required to retain these forms by the Local Authority, after which time they are shredded.

We ensure that the existence of our setting is widely advertised in places accessible to all sections of the community.
We ensure that information about our setting is accessible, using simple plain English, in written and spoken form and, where appropriate, provided in different community languages and in other formats on request.
We arrange our waiting list in birth order. In addition, our policy may take into account:

- the age of the child, with priority given to children who are eligible for the free entitlement – including eligible two-year-old children;

- the length of time on the waiting list;

- the vicinity of the home to the setting;

- whether any siblings already attend the setting; and

- the capacity of the setting to meet the individual needs of the child.

We offer funded places in accordance with any local conditions in place at the time.
We keep a place vacant, if this is financially viable, to accommodate an emergency admission.
Our setting and its practices are welcoming and make it clear that fathers, mothers, other relations and carers are all welcome.
Our setting and its practices operate in a way that encourages positive regard for and understanding of difference and ability - whether gender, family structure, class, background, religion, ethnicity or competence in spoken English.
We support children and/or parents with disabilities to take full part in all activities within our setting.
We monitor the needs and background of children joining our setting on the Registration Form, to ensure that no accidental or unintentional discrimination is taking place.
We share and widely promote our Valuing Diversity and Promoting Equality Policy.
We consult with families about the opening times of our setting to ensure that we accommodate a broad range of families' needs.
We are flexible about attendance patterns to accommodate the needs of individual children and families, providing these do not disrupt the pattern of continuity in the setting that provides stability for all the children.
Failure to comply with the terms and conditions may ultimately result in the provision of a place being withdrawn.

Personal Data

We have been advised by the Information Commissioners Office that it is reasonable to keep a record of your mobile number on the mobile phone and your email address on our computer email provider for up to 1 financial year after your child leaves the setting, so we can contact you if necessary, to clarify, for example, accounts information or details relating to your Tax claim (if relevant). The data will be deleted after this period.

If we close our setting, we will keep documentation for as long as legally required by the purpose for which it was collected. There is no absolute duty to encrypt data stored on our memory stick but we will keep it as securely as possible during the retention period.

You have the right to ask for information held about you and your child to be withdrawn. This is called the ‘right to erasure’ in GDPR. However, if we need to keep information because it is legally required then exceptions to the ‘right to erasure’ apply. We will make a decision about each erasure request individually – please speak to the Manager for more information.

Most things that happen between the family, the child and the setting are confidential to our setting. In exceptional circumstances information is shared, for example with other professionals or possibly social care or the police.
Information shared with other agencies is done in line with our Information Sharing Policy.
We always check whether parents regard the information they share with us to be confidential or not.
Some parents may share information about themselves with other parents as well as with our staff; we cannot be held responsible if information is shared by those parents whom the person has ‘confided’ in.
Information shared between parents in a discussion or training group is usually bound by a shared agreement that the information is confidential to the group and not discussed outside of it. We are not responsible should that confidentiality be breached by participants.
We inform parents when we need to record confidential information beyond the general personal information we keep (see our Children's Records Policy) - for example with regard to any injuries, concerns or changes in relation to the child or the family, any discussions with parents on sensitive matters, any records we are obliged to keep regarding action taken in respect of child protection and any contact and correspondence with external agencies in relation to their child.
We keep all records securely (see our Children's Records Policy).
Most information is kept in a manual file. However, our staff may use a computer to type reports, or letters. Where this is the case, the typed document is deleted from the PC and only the hard copy kept. We do not keep electronic records on children, other than the register and financial data.
Where it is helpful to keep an electronic copy, we download it onto a disc, labelled with the child’s name and kept securely in the child’s file. No documents are kept on the hard drive. This is because the settings’ PC’s do not have facilities for confidential user folders.
Our staff discuss children’s general progress and well being together in meetings, but more sensitive information is restricted to our manager and the child’s key person, and is shared with other staff on a need to know basis.
We do not discuss children with staff who are not involved in the child’s care, nor with other parents or anyone else outside of the setting.
Our discussions with other professionals take place within a professional framework and not on an informal or ad-hoc basis.
Where third parties share information about an individual us; our practitioners and managers check if it is confidential, both in terms of the party sharing the information and of the person whom the information concerns.

Client access to records procedures

Parents may request access to any confidential records we hold on their child and family following the procedure below:

The parent is the ‘subject’ of the file in the case where a child is too young to give ‘informed consent’ and has a right to see information that our setting has compiled on them.
Any request to see the child’s personal file by a parent or person with parental responsibility must be made in writing to the setting manager.
We acknowledge the request in writing, informing the parent that an arrangement will be made for him/her to see the file contents, subject to third party consent.
Our written acknowledgement allows 40 working days for the file to be made ready.
A fee may be charged to the parent for admin costs.
Our manager informs the chairperson and legal advice may be sought before sharing a file.
Our manager goes through the file with the chairperson and ensures that all documents have been filed correctly, that entries are in date order and that there are no missing pages. They note any information, entry or correspondence or other document which mentions a third party.
We write to each of those individuals explaining that the subject has requested sight of the file, which contains a reference to them, stating what this is.
They are asked to reply in writing to our manager giving or refusing consent for disclosure of that material.
We keep copies of these letters and their replies on the child’s file.
‘Third parties’ include each family member noted on the file; so, where there are separate entries pertaining to each parent, stepparent, grandparent etc, we write to each of them to request third party consent.
Third parties also include workers from any other agency, including children's social care and the health authority for example. Agencies will normally refuse consent to share information, preferring instead for the parent to be redirected to those agencies for a request to see their file held by that agency.
Members of our staff should also be written to, but we reserve the right under the legislation to override a refusal for consent or to just delete the name of the staff member and not the information. We may grant refusal if the member of staff has provided information that could be considered ‘sensitive’ and the staff member may be in danger if that information is disclosed; or if that information is the basis of a police investigation. However, if the information is not sensitive, then it is not in our interest to withhold that information from a parent. In each case this should be discussed with members of staff and decisions recorded.
When we have received all the consents/refusals our manager takes a photocopy of the complete file. On the copy of the file, our manager removes any information that a third party has refused consent for us to disclose and blank out any references to the third party, and any information they have added to the file, using a thick marker pen.
The copy file is then checked by the chairperson and legal advisors to verify that the file has been prepared appropriately.
What remains is the information recorded by the setting, detailing the work initiated and followed by them in relation to confidential matters. This is called the ‘clean copy’.
We photocopy the ‘clean copy’ again and collate it for the parent to see.
Our manager informs the parent that the file is now ready and invite[s] him/ her to make an appointment to view it.
Our manager and the chairperson meet with the parent to go through the file, explaining the process as well as what the content of the file records about the child and the work that has been done. Only the person(s) with parental responsibility can attend that meeting, or the parent’s legal representative or interpreter.
The parent may take a copy of the prepared file away; but, to ensure it is properly explained to and understood by the parent, we never hand it over without discussion.
It is an offence to remove material that is controversial or to rewrite records to make them more acceptable. Our recording procedures and guidelines ensure that the material reflects an accurate and non-judgemental account of the work we have done with the family.
If a parent feels aggrieved about any entry in the file, or the resulting outcome, then we refer the parent to our complaint’s procedure.
The law requires that the information we hold must be accurate. If a parent says that the information, we hold is inaccurate, then the parent has a right to request for it to be changed. However, this only pertains to factual inaccuracies. Where the disputed entry is a matter of opinion, professional judgement, or represents a different view of the matter than that held by the parent, we retain the right not to change that entry, but we can record the parent’s view of the matter. In most cases, we would have given a parent the opportunity at the time to state their side of the matter, and it would have been recorded there and then.
If there are any controversial aspects of the content of a child’s file, we must seek legal advice. This might be where there is a court case between parents, where social care or the police may be considering legal action, or where a case has already completed and an appeal process is underway.
We never ‘under-record’ for fear of the parent seeing, nor do we make ‘personal notes’ elsewhere.

Telephone advice regarding general queries may be made to The Information Commissioner’s Office Helpline 0303 123 1113.

All the undertakings above are subject to the paramount commitment of our setting, which is to the safety and well-being of the child. Please see also our policy on Safeguarding Children and Child Protection.

Legal framework

Data Protection Act 1998
Human Rights Act 1998
Freedom of Information Act (2000)
Children Act (1989)