Under the new General Data Protection Regulations (GDPR) All Early years and Childcare settings are required to have transparency on the way they collate, store and use any personal information pertaining to the children in their care and their families. Parents have the right to ask that personal data is destroyed or deleted once they have left a setting providing deleting the material does not impact on Ofsted and legal regulations. Please refer to our Privacy Agreement.
Data we retain about you and your child falls into 3 main categories –
- Safeguarding and welfare data linked to Ofsted and the Early Years Foundation Stage requirements and the Limitation Act
- Financial data retained for HMRC purposes
- Funding data retained for Local Authority purposes
Data relating to the Safeguarding and Welfare requirements of the EYFS
We store data about you and your child in paper format and online. To comply with the Limitation Act 1980, we must keep Accident and First Aid Records, Administering Medication Records & Attendance Records using the legal basis of “Legal Obligation” until your child is 21 years and 3 months and for insurance requirements.
Attached these records we will also retain Parent Contracts and Attendance Registers using the legal basis of “vital interests “to provide additional evidence of compliance with the Early Years Foundation Stage.
We keep further data related to Safeguarding and Welfare requirements of the Early Years Foundation Stage and Childcare Register for a “reasonable period of time”
ICO advice is it should be retained between Ofsted inspections or within the Ofsted inspection cycle which might be between 3 and 8 years.
Information is kept in paper format and after the required retention period the documents will be shredded.
Data relating to the Learning and Development requirements of the EYFS
To comply with the EYFS, we keep documents relating to your child’s learning and development including taking photos of your child’s progress, activities and experiences.
We use the legal basis of “legal obligation” when recording your child’s learning, development and progress and “legitimate interest” when taking photos of your child because we believe it is reasonable for the setting to process this data to provide you with a good quality service.
We keep the information, including photos and will pass them on to you when your child leaves the setting or starts school, whichever comes first.
Financial record keeping
We keep documentation including your name, address and payment record for HMRC using the legal basis of “legal obligation”. We keep this information online and are required to retain this information by HMRC for 6 years after which time they are deleted.
Data relating to Local Authority funding forms
We may keep documentation including your name, address and national insurance number for the Local Authority Funding forms using the legal basis of “contractual necessity”. This is held in paper format and we am required to retain these forms by the Local Authority, after which time they are shredded.
Personal data
We have been advised by the Information Commissioners Office that it is reasonable to keep a record of your mobile phone number on our Nursery mobile phone and your email address on my computer email provider for up to 1 financial year after your child leaves the setting, so we can contact you if necessary to clarify any information or details relating to past information shared, after which the data will be deleted.
If we close the setting we will keep documentation for as long as legally required by the purpose for which it was collected. We will keep it as securely as possible during the retention period. You have the right to ask for information held by you and your child to be withdrawn. This is called the “right to erasure” in GDPR. However, if we need to keep information because it is legally required then exceptions to the “right to erasure” apply. we will make a decision about each erasure request individually.
Procedure
Data required by myself to ensure I follow all GDPR and Ofsted requirements are as follows
- Personal information-
- Parents names,
- Childs name
- DOB Address
- Contact Details
- Drs name
- Parental Responsibility
- Medical information
- EYFS
Under the new GDPR we are required to inform parents of how personal information is collected, stored and used, in this setting all information is paper based and is kept in a secure file, no unauthorised persons are allowed to access it without parental permission. Information cannot be shared without parental permission unless it is a Safeguarding concern. Mobile numbers are stored on our mobile phone as supplied by parents; once a parent leaves we will delete those numbers if requested. We use WhatsApp to send photos and pertinent information to all parents about their child's day to day activities and routine, this will continue under the new GDPR and again all data will be deleted at parent’s request.
We use a Nursery mobile phone to take photos of your child which are used in your child's “Learning Journey” and are deleted as soon as they are printed, group photos are placed in other children’s files on the understanding that once another child leaves the setting, when their learning journey is given to parents as required under Ofsted regulations, those photos are no longer my responsibility and cannot be deleted or destroyed even if requested. Photos will not be used for any commercial or public use at any time.
In order to comply with GDPR we are required to inform you that you may access any personal data we hold on your child or your family and we agree to hold all this information securely until such time as you request deletion providing this does not compromise Ofsted, DFE or HMRC regulations. Any Data relating to Safeguarding/Accidents or Incidents must be retained until the individual child reaches the age of 21 years and 3 months as required by law so is exempt from the privacy laws as Safeguarding concerns override any other requirements or regulations.
For details of how long we are required to hold pertinent data on your family or child please see the list below
PERSONAL INFORMATION - Kept for 6 years
- Shared care information sheets
- Permission sheets
- Accounts
- Funding sheets
SENSITIVE INFORMATION-Kept until child reaches 21 years and 3 months of age
- Accident sheets
- Incident sheets
- Injuries sheets
- Safeguarding concerns
- Attendance records
OTHER DATA
- PHOTOGRAPHS - Deleted as soon as child leaves unless written permission is obtained in which case they will be kept securely and only used for private use
- LEARNING JOURNEYS - Go with child when they leave