As a childcare provider we are a data controller under the Data Protection Act 2018 and General Data Protection Regulation (GDPR) 2016. We hold and process personal information from third parties supplied in accordance with these Acts.
We may use employee’s details, parents’ / carers’ and children’s personal information to provide our childcare services, to meet our statutory obligations as a childcare provider and an employer and to contact them. Where personal data of third parties is provided by parents/carers and employees, we will assume that they have obtained the required authority to supply this information to us unless you tell us otherwise.
We will not transfer or otherwise disclose to third parties your personal data or personal data of others you have provided to us except:
(Please also see our Safeguarding Children and Child Protection Policy.)
We are registered with the Information Commissioner’s Office (ICO) for Data Protection.
We are aware of our responsibilities under the Data Protection Act 2018, GDPR 2016 and the Freedom of Information Act 2000 regarding the collection, storage, and destruction of personal data.
Under these Regulations and Acts, personal data must be:
Under these Regulations and Acts employees, parents, children, visitors, and other members of the public have the right to:
Personal Information is defined as any details relating to a living, identifiable individual. Within our childcare setting this relates to employees, children and their families, professional visitors, and some members of the public e.g. job applicants. The information collected must be for the legitimate business of our childcare setting. In general, the individual concerned must agree that they understand and give permission for the declared processing to take place – although legislation will take precedence.
We need to ensure that the information gained from each individual is kept securely and to the appropriate level of confidentiality.
The personal information (personal identifiers) collected regarding a child and their family using our setting could include:
The personal information collected regarding employees could include:
It is the responsibility of parents/carers and employees to ensure that they have the permission of their emergency contacts to pass us their contact details. They must also ensure the emergency contact is aware that we will store their contact details as detailed in this policy.
We store personal information to comply with the EYFS 2017, the Childcare (General Childcare Register) Regulations 2008, the Childcare Act 2006 and the requirements of our childcare registration to deliver services to families and to employ suitable people for my setting. It is also to meet the requirements of being an employer (e.g. HMRC, Pensions Regulator)
Parents / carers are responsible for checking that any information that they provide to us in connection with their child(ren)’s care is accurate and up to date.
This includes changes in their own and their child’s personal information.
Employees are responsible for checking that any information that they provide to me in connection with their employment is accurate and up to date.
We will regularly ask parents/carers and employees to check their records, but it is their responsibility to inform us of any changes as soon as is reasonably practicable.
If there are changes in the suitability of staff to work with children (including changes in suitability by association), they must inform me immediately.
We are responsible for ensuring that:
Staff should note that unauthorised disclosure will usually be a disciplinary matter and may be considered gross misconduct in some cases.
Personal information that is recorded on paper will be:
Personal information that is computerised will be:
Our premises are secure and we use a visitor book to record visitors, who are never left unattended.
It is occasionally necessary for us to take personal information off the premises – for example to attend a meeting with another setting that that child attends or to attend a meeting with another professional that is working with a child. This information may include documents that include the child’s name, address, date of birth, learning and development records, reports from other professionals, and personal information and contact details of parents/carers. Information will be transported securely and will not be left in any vehicle. There may be occasions when a staff member may attend the meeting – if they are unable to return any documents to my setting on the same day, they will keep the documents securely until they return the following day.
Personal identifiers could be included in the following paper data:
Parents who are eligible to claim 15 or 30 hours early education funding are required to complete Local Authority parent declaration forms. These forms include identifiers such as parents’ / carers’ names and National Insurance numbers and the child’s personal details and characteristics such as ethnic group.
We use a computer and mobile phone for business purposes. Computer and mobile phone security includes regularly updated antivirus software and secure password protection (regularly changed). Personal identifiers could be included in the following data that I may hold in computerised form:
We use google to process emails and my email provider is Gmail. We keep a copy of parent/carer and staff email addresses on my computer and mobile phone to allow me to process emails quickly.
Sensitive data sent to (or from) Ofsted by email will always be sent securely using Egress Switch to encrypt the email and any file attachments.
If we need to email sensitive information to a recipient that is unable to receive Egress Switch, we will ensure it is password encrypted and the password shared in a separate email.
I use Sky as my mobile phone provider to send and receive text and Whatsapp messages. I keep a copy of parent/carer and staff mobile phone number and those of their emergency contacts in my mobile phone contact list.
We use Facebook so parents/carers can see what we do in the setting during the day. We also use it to advertise our business. With parental/carers’ permission,
we may put photos of their child(ren) on our Facebook page, but in all cases, children’s faces are always obscured for their own safety, even if permission to show their face has been granted.
Likewise, with their permission, I may also put photos of employees on my Facebook page.
With parental/carers’ permission we use Famly to record their child’s learning and development records (learning journals). This includes identifiers such as parents’/ carers’ names and email addresses, the child’s personal details and photographs of the child.
Information of a personal or confidential nature will not be discussed in a public area. We are aware of confidentiality at all times when discussions are taking place and do our upmost to ensure discussions are not overheard by others. Our staff will distance themselves from a conversation if it does not concern them. We will respect the confidential nature of any information inadvertently overheard.
Sensitive information is defined by regulation as that relating to ethnicity, political opinions, religious beliefs, trade union membership, physical or mental health, sex life, criminal proceedings or convictions. The person about whom this data is being kept must give express consent to the processing of such data, except where the data processing is required by law for employment purposes or to protect the vital interests of the person or a third party.
Photographs and videos are a useful way of recording activities and achievements. We ensure we have parental/carer’s permission before taking photographs / videos of children, which will only be used for appropriate recording purposes. If we use a mobile phone or tablet for taking photos/videos, we will ensure it is password protected. We will obtain permission from parents / carers for all uses of photos / videos. We will obtain written permission from parents/carers if we wish to keep photographs/videos of their child indefinitely for our own personal photo album and/or for a defined number of years for business purposes (e.g. the marketing of our childcare business) after the child has left our setting. Likewise we ensure we have permission of our employees before taking and using their photograph/video.
We have an Information Sharing Policy and work to the principles of the seven golden rules to sharing information, which can be found in ‘Information Sharing – Advice for practitioners providing safeguarding services to children, young people, parents and carers’ (2018) (copy available if required). Ofsted may request to see our records at any time.
We take care to only store personal information that is absolutely necessary. We store data for the period of time required by legislation, our Local Safeguarding Children’s Board or as recommended by the Information and Records Management Society (IRMS). For retention periods please see the Appendix to this policy.
All personal information is disposed of safely when it is no longer needed, following the retention guidelines and statutory requirements.
We take confidentiality and security very seriously. Any incident of data breach will be recorded and reported to those affected and to the ICO: https://ico.org.uk/for-organisations/report-a-breach/
We will carry out a risk assessment to minimise the risk of it occurring again.
Types of data breach include:
Unless there are specific reasons regarding child protection that we have been advised by the Local Safeguarding Children Board, parents/carers will have access to their own records and to those of their child(ren) and have the right to see them at any time.
Likewise, employees have the right to access any personal data that is being kept about them.
If parents/carers or staff wish to see these records, they should discuss this with us.
Parents/carers have the right to ask for personal data held about them and/or their child(ren) to be erased – this is known as ‘right to erasure’. we will conform to such requests unless we have a statutory duty to retain the data. Likewise, employees have the right to erasure.
We will make a decision about erasure on an individual case basis.
Parents/carers or employees should speak to us for more information.
If you are concerned about a data breach or the way in which we collect, store or share information, you can contact the Information Commissioner’s Office: 0303 123 1113
I expect any information shared regarding our employees to remain confidential if requested.
If you have any concerns regarding this policy, please do discuss them with us.
