Guvnor
Education & Training

Record-Keeping and Data Protection for Childcare Providers

Mandatory record-keeping requirements for childcare providers under EYFS, data protection obligations under UK GDPR, and how to handle complaints and significant events.

UK-wide
Guide summary

As a childcare provider, you must keep detailed records and protect children's personal data. This is required by law to keep children safe and avoid fines. You must also have clear procedures for handling complaints and reporting serious events.

  • Keep daily attendance, accident, and medication records
  • Store safeguarding records securely for 25 years
  • Get parents' written consent before using photos
  • Pay the ICO data protection fee (usually £40 a year)
  • Report serious data breaches to ICO within 72 hours
  • Have a written complaints policy for parents
  • Investigate complaints and reply within 28 days
  • Notify Ofsted of serious incidents within 14 days
On this page
UK-wide

Childcare providers must maintain detailed records to meet EYFS statutory requirements, and process personal data in compliance with UK GDPR. Poor record-keeping is a common finding in Ofsted inspections and can lead to enforcement action.

Mandatory records

EYFS requires you to maintain the following records at all times:

Data protection

You process sensitive personal data about children and families, which requires careful compliance with UK GDPR:

Complaints and significant events

You must have clear procedures for handling complaints and notifying Ofsted of significant events:

Prepare for an Ofsted Inspection

How to prepare for an Ofsted inspection of your childcare setting. Covers what inspectors look for under the Education Inspection Framework, self-evaluation, evidence gathering, and how to handle the inspection day.

Tech Sector Compliance Overview

Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific requirements.

Tech Sector Licensing and Authorisations

Comprehensive guide to licences and regulatory authorisations required for technology businesses - telecommunications, financial services, intellectual property, export controls, and product safety.

Cryptoasset Business Regulation

Regulatory requirements for cryptoasset businesses in the UK - how token classification determines whether you need full FCA authorisation or Money Laundering Regulations registration only.