Data Protection

In order to provide a quality early years and childcare service and comply with legislation, we will need to request information from parents about their child and family. Some of this will be personal data.

We take families’ privacy seriously, and in accordance with the General Data Protection Regulation (GDPR), we will process any personal data according to the seven principles below:

  1. We must have a lawful reason for collecting personal data, and must do it in a fair and transparent way. We will be clear about what data we are collecting, and why.
  2. We must only use the data for the reason it is initially obtained. This means we cannot use a person’s data to market a product or service to them that is unconnected to the reasons for which they shared the data with us in the first place.
  3. We must not collect any more data than is necessary. We will only collect the data we need to hold in order to do the job for which we have collected the data.
  4. We will ensure that the data is accurate, and ask parents to check annually and confirm that the data held is still accurate.
  5. We will not keep data any longer than needed. We must only keep the data for as long as is needed to complete the tasks it was collected for.
  6. We must protect the personal data. We are responsible for ensuring that we, and anyone else charged with using the data, processes and stores it securely.
  7. We will be accountable for that data. This means that we will be able to show how we (and anyone working with us) are complying with the law.


We are registered with the Information Commissioner’s Office, the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

We expect parents to keep private and confidential any sensitive information they may accidently learn about pre school or other children and families attending pre school, unless it is a child protection issue.

We will be asking parents for personal data about themselves and their child/ren in order to deliver a childcare service (see privacy notice). We are required to hold and use this personal data in order to comply with the statutory framework for the early years foundation stage, Ofsted, Department for Education and our local authority.


Subject access

Parents have the right to inspect records about their child at any time. This will be provided without delay and no later than one month after the request, which should be made in writing. We will ask parents to regularly check that data is correct and update it where necessary.



We will keep all paper based records about children and their families securely locked away.

If we keep records relating to individual children on our computer, externally or in storage such as icloud, Google Drive or Dropbox, including photos we will obtain parents’ permission. We will store information securely, for example, in password protected files, to prevent viewing of the information by others with access to the computer.

Backup files will be stored on an encrypted memory stick, which will be locked away when not being used. Firewall and virus protection software is in place.


Information sharing

We are expected to share information with other childcare providers if a child also attends another setting.

We are also required to share information with Dudley MBC in regards to the childcare and early years entitlements.

We will not share any information with anyone without parent’s consent unless there is a child protection concern.

Ofsted may require access to our records at any time.

Record Keeping

We record all accidents in our accident book.

We will notify PACEY of any accidents which may result in an insurance claim, e.g. an accident resulting in a doctor or hospital visit. PACEY will log and acknowledge receipt of the correspondence and forward the information to the company providing my public liability insurance policy to enable a claim to be allocated.

We will inform Ofsted, the Dudley safeguarding board and Health and Safety Executive of any significant injuries, accidents or deaths as soon as possible.

We record all significant incidents in an incident book and we will share these with parents so that together we can work to resolve any issues.

We will only share information if it is in a child’s best interests to do so. For example in a medical emergency we will share medical information with a healthcare professional. If we are worried about a child’s welfare we have a legal duty of care to follow our Local Safeguarding Children Board procedures and make a referral.  Where possible we will discuss concerns with parents before making a referral.


If we are worried about a child’s welfare we have a legal duty of       care to follow our Local Safeguarding Children Board procedures and make a referral. Where possible we will discuss concerns with parents before making a referral.
With regards to documentation, If a child is known to children’s services, even if the case is closed all documentation will be transferred over to the new setting so they can understand the child’s background. And a copy will be kept with us until the child is 25 years old, and then will be disposed of appropriately and securely.

Safe disposal of data

We are required by law to keep some data for some time after a child has left the setting. We have a review plan in place and ensure that any data is disposed of appropriately and securely.

Suspected breach

If we suspect that data has been accessed unlawfully, we will inform the relevant parties immediately and report to the Information Commissioner’s Office within 72 hours. we will keep a record of any data breach.