In order to provide a quality childcare service and comply with legislation, I will need to request information from parents about their child and family. Some of this will be personal data.

I take families’ privacy seriously, and in accordance with the General Data Protection Regulation , I will process any personal data according to the seven principles below:

1. I must have a lawful reason for collecting personal data and must do it in a fair and transparent way.

2. I must only use the data for the reason it is initially obtained.

3. I must not collect any more data than is necessary.

4. I will ensure that the data is accurate and ask parents to check annually and confirm the data held is accurate.

5. I will not keep data any longer than needed.

6. I must protect the personal data, processing and storing it securely.

7. I will be accountable for the data ensuring I am able to show how I am complying with the law.

Access to Data

Parents have the right to inspect records about their child at any time.

I will ask parents to regularly check that the data is correct and update it where necessary.

Storage

I will keep all paper-based records about children and their families securely locked away.

If I keep records relating to individual children on my computer, externally or cloud storage such as iCloud, including digital photos or videos, I will obtain parents’ permission.

Information Sharing

I am expected to share information with other childcare providers if a child also attends another setting.

I am also required to share information with the Local Authority regarding the childcare and early years entitlements.

I will not share any information with anyone without parents’ consent, unless there is a child protection concern.

CSSIW may require access to my records at any time.

Record Keeping

I record all accidents in an accident book.

I will notify PACEY of an accidents which may result in an insurance claim, eg. An accident resulting in a doctor or hospital visit. PACEY will log and acknowledge receipt of the correspondence and forward the information to the company providing my public liability insurance to enable a claim number to be generated.

I will inform CSSIW, the local child protection agency and the Health and Safety Executive of any significant injuries, accidents or deaths as soon as possible.

I will only share information if it is in a child’s best interest to do so. For example, in a medical emergency, I will share medical information with a healthcare professional. If I am worried about s child’s welfare I have a duty of care to follow the Local Safeguarding Children Board procedures and make a referral. Where possible I will discuss concerns with you before making a referral.

Suspected breach

If I suspect that data has been accessed unlawfully, I will inform the relevant parties immediately and report to the Information Commissioner’s Office within 72 hours. I will keep a record of any data breach.