Record-Keeping and Data Protection for Childcare Providers

Guide summary

Keep records of children's attendance, accidents, medication, and safeguarding concerns as required by EYFS. Protect personal data under UK GDPR and register with the ICO if you handle children's data. Tell Ofsted within 14 days of any serious incident or complaint about safety.

Keep attendance, accident, medication, and safeguarding records
Store safeguarding records separately for 25 years
Keep accident records until the child turns 21 years and 3 months
Register with the ICO and pay the £52 fee if you have 10 or fewer staff
Report data breaches to the ICO within 72 hours
Notify Ofsted within 14 days of serious injury or staff allegations
Respond to all complaints within 28 days

Childcare providers must maintain detailed records to meet EYFS statutory requirements, and process personal data in compliance with UK GDPR. Poor record-keeping is a common finding in Ofsted inspections and can lead to enforcement action.

Mandatory records

EYFS requires you to maintain the following records at all times:

Mandatory Record-Keeping for Childcare Providers

Attendance registers: Record daily attendance including arrival and departure times for each child. Must also record names of children's key person and who collected the child
Accident and incident records: Record all accidents, injuries, and incidents including date, time, description, treatment given, witnesses, and notification to parents. Retain until the child is aged 21 years and 3 months (insurer minimum); many settings keep them until age 25 per sector guidance
Medication records: Written parental permission before administering every medicine, both prescription and non-prescription. Record medication name, dose, time, who administered, and any reactions. Medicine containing aspirin may only be given if prescribed by a doctor
Safeguarding records: Chronological concern records with dates, observations, actions taken, and referral outcomes. Store securely and separately from children's learning records. Retain for 25 years or until child reaches age 25
Staff records: DBS certificate details (not copies), qualifications, training log, references, employment history, right to work evidence, disqualification declaration, supervision and appraisal records
Risk assessments: Written risk assessments for premises, activities, and outings. Daily premises check records. Review and update at least annually
Complaints log: Written record of all complaints received, investigation actions, outcomes, and timescales. Retain for 3 years from date of complaint
Fire drill log: Record all fire drills including date, time, number of children, evacuation time, and any issues identified
Food safety records: HACCP records, daily temperature checks for fridges/freezers, allergen information for each child, food hygiene certificates
Retention summary: Accident records — until age 21 years 3 months (insurer minimum; many settings keep to age 25). Safeguarding — 25 years. Staff records — 6 years after leaving. Complaints — 3 years. Financial — 6 years. Attendance registers — 3 years

Data protection

You process sensitive personal data about children and families, which requires careful compliance with UK GDPR:

Data Protection for Childcare Settings

Lawful basis for processing: Legal obligation (EYFS record-keeping requirements) and legitimate interests (safeguarding children). Consent is NOT the appropriate lawful basis for mandatory records
Privacy notices for parents: Provide a privacy notice explaining what personal data you collect, why, how long you keep it, who you share it with, and parents' rights. Issue at registration
Photograph consent: Obtain specific written consent for photographs of children. Separate consent for learning journals, marketing/website, social media. Parents can withdraw consent at any time
Sharing information with schools: Share EYFS Profile and learning records with receiving school at transition. Lawful basis is legal obligation under EYFS. Parents should be informed but consent is not required
Sharing with local authorities: Share information with local authority early years teams for moderation, funding claims, and safeguarding. Lawful basis is legal obligation
ICO registration: Most childcare providers must pay the ICO data protection fee. Tier 1 fee is GBP 52 per year for micro-organisations (turnover of no more than GBP 632,000 or no more than 10 staff)
ICO exemption: Some very small providers processing only personal data for staff administration and accounts (not marketing or complex processing) may be exempt. Check ICO self-assessment tool
Data retention: Only keep personal data as long as necessary. Delete or anonymise when retention period expires. See record-keeping requirements for specific retention periods
Data breaches: Report notifiable breaches to the ICO within 72 hours. Inform affected individuals without undue delay if there is a high risk to their rights

Complaints and significant events

You must have clear procedures for handling complaints and notifying Ofsted of significant events:

Complaints Procedures for Childcare Providers

Written complaints policy: EYFS requires all providers to have a written complaints procedure. The procedure must be shared with parents and available on request
Investigation timescale: Investigate and respond to complaints within 28 days. Keep the complainant informed of progress throughout
Complaints record: Record all complaints including date received, nature of complaint, investigation actions, outcome, and any changes made. Records must be available to Ofsted
Notify Ofsted — complaints: Notify Ofsted of any complaint that alleges the provider is not meeting EYFS requirements, or that relates to the safety or welfare of a child
Notify Ofsted — significant events: Notify Ofsted within 14 days of any significant event including serious injury, food poisoning affecting 2+ children, allegations against staff, or any incident requiring police or social services involvement
Parents' right to complain to Ofsted: Parents have the right to complain directly to Ofsted at any time. Display Ofsted contact details (0300 123 4666) and advise parents of this right in your complaints policy
Retention period: Retain complaints records for at least 3 years from the date of the complaint
Annual summary: Make available to Ofsted on request a summary of complaints made in the past 12 months, including outcomes and any actions taken

Legal basis

Primary legislation and key regulations

Data Protection Act 2018 Primary 2018 · UK-wide Childcare Act 2006 Primary 2006 · UK-wide Early Years Foundation Stage (Welfare Requirements) Regulations 2012 SI 2012 · UK-wide

Browse UK legislation legislation.gov.uk

Official guidance

Childcare: significant events to notify Ofsted about (opens in a new tab)

Ofsted

Registering and inspecting school-based provision (opens in a new tab)

Ofsted

Check if you need to register - ICO self-assessment tool (opens in a new tab)

ICO

Cookies and similar technologies (ICO) (opens in a new tab)

ICO

Data protection and your business (GOV.UK) (opens in a new tab)

ICO

Data protection fee exemptions (opens in a new tab)

ICO

Record-Keeping and Data Protection for Childcare Providers

Mandatory records

Data protection

Complaints and significant events

Legal basis

Official guidance

Related guides in Data Protection

Prepare for an Ofsted Inspection

Tech Sector Compliance Overview

Tech Sector Licensing and Authorisations

Cryptoasset Business Regulation

Privacy and Electronic Communications Regulations