Nursery GDPR: 10 Data Protection Issues Every Early Years Leader Should Check

Nurseries and early years settings handle an extraordinary amount of personal information.

Children’s medical and SEND information. Safeguarding records. Family circumstances. Photographs and videos. Learning journals. Emergency contacts. Staff information. Funding records. Information about separated parents. Details shared with health professionals, local authorities and other agencies.

Much of it is sensitive, and much of it relates to very young children.

Yet data protection in an early years setting should not be about creating paperwork for the sake of it. It is about knowing what information you hold, why you need it, who can access it, when it can be shared and how you keep it secure.

Here are 10 areas worth checking in your setting.

1. Are your privacy notices actually up to date?

A privacy notice should reflect what your setting really does with personal information, rather than simply being a document that has been sitting on the website for several years.

Think about what has changed.

Have you introduced a new learning journal, parent communication app, payment system, CCTV system or HR platform? Do you now use different external professionals or service providers?

Parents and staff should be able to understand what information you collect, why you use it, who it may be shared with and what their rights are.

Early years settings themselves have responsibilities under UK GDPR and the Data Protection Act 2018, including transparency about the information they hold and how it is used.

Check: Does your privacy notice describe what actually happens in your setting today?

2. Do staff understand when safeguarding information can be shared?

One of the most damaging data protection myths is:

“We can’t share that because of GDPR.”

Data protection law does not prevent appropriate information sharing to safeguard a child.

Indeed, the government’s statutory information-sharing guidance was updated in September 2026 to reflect the new Information Sharing Duty coming into force on 30 September 2026, and it expressly applies to early years as well as education and other safeguarding services.

The important questions are what needs to be shared, with whom, why, how securely, and what should be recorded.

Consent is also not always required or appropriate when information needs to be shared for safeguarding purposes.

Check: Would your practitioners know what to do if they needed to share information urgently to protect a child?

3. Are photographs and videos being managed properly?

Early years settings can generate hundreds or thousands of images.

They may appear in learning journals, displays, newsletters, observations, websites, social media and communications with parents.

But are you clear about the purpose for which each image is being used?

DfE guidance makes an important distinction: permission is not automatically required every time an image is taken, but settings need to understand their lawful basis and check restrictions before images are used, stored or published. Particular care is necessary where identifying a child could create a safeguarding risk.

Check: Are your photo/video permissions, privacy information and actual staff practice consistent with one another?

4. Have you checked your apps and online systems?

Learning journals, parent apps, safeguarding systems, payment platforms and communication tools can all process children’s or family information.

Before introducing a new system, somebody should be asking:

What data does it collect? Where is it stored? Who can access it? What does the supplier do with it? How long is it retained? Are there additional risks to children?

Schools themselves are not subject to the ICO Children’s Code when processing children’s information for education, but technology providers can fall within its scope depending on how they process children’s information. Ordinary UK GDPR obligations continue to apply regardless.

Higher-risk processing may also require a Data Protection Impact Assessment (DPIA) before it begins.

Check: Do you have a process for assessing data protection before somebody signs up for the next useful-looking app?

5. Would you recognise a data breach?

A breach isn’t just a cyberattack.

It could be:

• an email sent to the wrong parent;

• paperwork left somewhere it should not be;

• a lost device;

• information about one family accidentally shared with another;

• inappropriate access to a child’s record;

• an attachment containing information about other children;

• or photographs being disclosed to the wrong people.

Staff should know who to tell immediately.

The first question shouldn’t be “Will we get into trouble?” It should be “What happened, whose information is affected, what is the risk, and what do we need to do now?”

Check: Could every member of staff explain how to report a suspected data breach?

6. Are you prepared for a Subject Access Request?

Parents and others may ask to see personal information to which they are entitled.

That request doesn’t necessarily arrive with the words “Subject Access Request” written across the top.

It might simply say:

“Please send me everything you hold about my child.”

The setting needs to recognise the request, establish whose information is being requested, locate relevant records and consider information relating to other people before anything is disclosed.

Emails, electronic systems and other records may all be relevant – not merely the child’s main file.

Check: Would the person opening your nursery inbox recognise a potential SAR and know who should deal with it?

7. Are you keeping information for the right length of time?

Keeping everything forever can feel safer.

It isn’t necessarily safer from a data protection perspective.

Settings need appropriate retention arrangements covering children’s records, safeguarding material, accident records, recruitment information, staff files, financial records, photographs and other information.

Different records may need to be retained for different periods.

Once information no longer needs to be retained, it should be securely disposed of in accordance with your retention arrangements.

Check: Do you have a retention schedule – and is anyone actually using it?

8. What happens when parents separate?

This can quickly become complicated.

Who has parental responsibility? What information is each person entitled to receive? Is there a court order? Is there a safeguarding concern? Has somebody asked the nursery not to disclose an address or other information?

Staff should avoid making assumptions based simply on who normally drops the child off or whose name appears first on a form.

These situations often involve both data protection and safeguarding considerations, so they need careful handling.

Check: Would staff know who to escalate a difficult parental-information request to?

9. Is access to children’s information properly controlled?

Not every member of staff needs access to everything.

Consider your nursery management system, safeguarding platform, shared drives, email accounts, tablets and paper records.

When somebody changes role or leaves, are their permissions changed promptly?

And what about agency staff, volunteers, students and external professionals?

Security isn’t only about passwords and firewalls. It is also about making sure the right people have the right access for the right reasons.

DfE’s early-years census guidance emphasises that settings have responsibilities for security extending to organisations accessing information on their behalf, such as external IT suppliers, and that staff need appropriate initial and refresher training.

Check: When did you last review who can access your key systems?

10. Do you know who to call when something goes wrong?

This is perhaps the most practical test of all.

A good Data Protection Officer should not simply be a name at the bottom of a privacy notice.

When a parent submits a complicated SAR, a member of staff sends information to the wrong person, a new app needs assessing, safeguarding information needs sharing or the setting receives correspondence from the ICO, you should know where to get timely, practical advice.

Data protection works best when leaders can ask for help before a small issue becomes a larger one.

A quick test for your setting

Ask yourself:

If one of these ten issues happened tomorrow, would we know exactly what to do?

If the answer to some of them is “not quite”, that doesn’t necessarily mean you have a major compliance problem. It tells you where some practical work may be worthwhile.

At SchoolDPO, we provide independent Data Protection Officer and wider policy/compliance support specifically for education settings, including schools, nurseries and early years providers.

We help with the day-to-day reality of data protection: SARs, breaches, DPIAs, privacy notices, information sharing, policies, new systems and those awkward questions where the answer isn’t immediately obvious.

Need help reviewing your setting’s data protection arrangements?

Visit SchoolDPO.com⁠ or get in touch for an informal conversation.