Confidentiality/Data Protection Policy

To provide a quality early years and childcare service and comply with legislation, I will be asking parents for personal data about themselves and their child/ren.   I am required to hold and use this personal data to comply with the statutory framework for the Early Years Foundation Stage, Ofsted, Department for Education and Surrey Local Authority.  Some of this will be personal data and some may be classed as special category data. 

I take families’ privacy seriously, and in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR), I will process any personal data according to the seven principles below:

1. I must have a lawful reason for collecting personal data and must do it in a fair and transparent way. I will be clear about what data I am collecting, and why.
2. I must only use the data for the reason it is initially obtained. This means that I may not use a person’s data inappropriately or to market a product or service to them that is unconnected to the reasons for which they shared the data with me in the first place, unless required to do so by law.
3. I must not collect any more data than is necessary. I will only collect the data I need to provide appropriate childcare services and abide by relevant laws.
4. I will ensure that the data is accurate.  I will check annually with parents/carers that the information I hold is still accurate.
5. I will not keep data any longer than needed. I must only keep the data for as long as is needed to complete the tasks it was collected for and in compliance with relevant laws.
6. I must protect personal data. I am responsible for ensuring that I, and anyone else charged with using the data, processes and stores it securely.
7. I will be accountable for the data. This means that I will be able to show how I am complying with the law.

Procedure

All information on children and their families is kept securely and treated in confidence.  All paper records are kept confidential and secure which I can access if required for inspection by Ofsted or by a parent/carer.  Electronic records are kept on my computer under a password protected file.  Antivirus and firewalls are installed.

Parents/guardians/carers have the right to inspect all records about their child at any time.

I am registered with the Information Commissioner’s Office, registration number Z6917502.

I archive records each year and store them in a secure location for a period of 7 years or as directed by law.  I encourage parents to inform me of any changes in the child’s information which includes new address, change in job, contact details etc.

I am expected to share information with other childcare providers if a child also attends another setting, but I will ask for specific permission to do this.  I am also required to share information with Surrey County Council regarding early years funding.  In some cases, I may need to share information without parents’ consent, if there is a child protection concern, criminal or tax investigations, health and safety reports etc.  Ofsted may require access to my records at any time.

I will only share information without your prior permission if it is in a child’s best interests to do so. For example, in a medical emergency I will share medical information with a healthcare professional. If I am worried about a child’s welfare, I have a duty of care to follow Surrey County Council procedures and make a referral via The Surrey Children’s Single Point of Access on 0300 4709100. Where possible I will discuss concerns with you before making a referral.

I expect parents to keep private and confidential any sensitive information they may accidentally learn about my family, my setting or the other children and families attending, unless it is a child protection issue.

The GDPR provides the following rights for individuals:

1. The right to be informed

2. The right of access

3. The right to rectification

4. The right to erasure

5. The right to restrict processing

6. The right to data portability

7. The right to object

8. Rights in relation to automated decision making and profiling

I will investigate any suspected breaches and take prompt action to correct any areas of concern. If I suspect that data has been accessed unlawfully, I will inform the relevant parties immediately and report to the Information Commissioner’s Office within 72 hours. I will keep a record of any data breach.

Please also see my other policies particularly Safeguarding Policy, Mobile phone camera internet and social networking policy.

Policy Written by: Ilana Hill             Date: 17 January 2011   Signature: ..................................

Last updated and reviewed on 15 May 2025