Privacy notice for a nursery or childcare business

A nursery holds more sensitive data about more vulnerable people than almost any other small business: children's medical and dietary needs, family circumstances, safeguarding concerns, daily observations and photographs, and the funding and attendance data the local authority requires. The privacy notice has to explain to parents what the nursery records, on what basis (the framework and the law, not consent), who sees it, which apps hold it, what is shared with the local authority and others, and how long the records are kept after the child leaves. A fixed £595 covers the privacy notice, the cookie notice and guidance on the consent mechanism, drafted for the business and delivered in five working days.

Who this is for

Day nurseries, pre-schools, nursery chains, out-of-school clubs and childminders in England registered with Ofsted or a childminder agency under the early years framework.

What matters in a nursery privacy notice

Children's data from the first enquiry to the last day

Article 13 of the UK GDPR obliges the business as controller to tell parents what it collects about them and their children: enquiry and waiting list data, registration forms, emergency contacts, medical and dietary information, daily records (meals, sleep, nappies, accidents), observations and assessments under the early years framework, photographs and videos, attendance, invoices and funding data, and the correspondence with parents; the notice should follow the child's journey through the setting so that parents can see what is recorded at each stage, and should say that the child is the data subject even though the parent supplies and receives the information.

The lawful basis for care, funding and the early years framework

The nursery processes most data under the contract with the parent under Article 6(1)(b) of the UK GDPR, legal obligation under Article 6(1)(c) for the record-keeping, safeguarding and reporting the Childcare Act 2006 and the statutory framework require and for the funding returns to the local authority, and legitimate interests under Article 6(1)(f) for the setting's operation, with consent kept for the optional (photographs for marketing, sharing with other parents, newsletters); the notice should state the bases accurately, because a nursery that says it relies on consent for the child's records has told parents they can withdraw it, which the framework does not allow.

Medical, dietary and family data that is special category

Allergies, medical conditions, medication, dietary requirements that reveal religion, special educational needs and family circumstances that touch on health or other protected matters are special category data under Article 9 of the UK GDPR, processed under the conditions in Schedule 1 to the Data Protection Act 2018 (safeguarding of children, health care purposes, substantial public interest) with the appropriate policy document, or under explicit consent where the parent chooses to disclose, and the notice should state the condition for each, who sees the information (the key person, the room staff, the cook for dietary needs, the manager, the first aider) and how it is kept; an allergy list on the kitchen wall is a disclosure the notice should anticipate.

Learning journals, photographs and the apps parents see

Most settings use an app for observations, learning journals, daily diaries and parent communication, which holds photographs and assessments of every child and is a processor under Article 28 of the UK GDPR with an agreement the nursery should hold and a check on where the data is hosted and whether it leaves the United Kingdom under Article 46; the notice should describe the app, what it holds, who can see a child's record (the child's parents only, with other children not visible in shared photographs without consent), the position on photographs taken on staff devices (prohibited), and the use of images for the setting's marketing (consent, revocable, with the images removed when it is withdrawn).

Safeguarding, the local authority and the records that are kept

The nursery shares data with the local authority (funding, census, safeguarding referrals, early help), with Ofsted or the childminder agency on inspection and notification, with health visitors and other professionals involved with the child, with the child's next setting or school on transition (the transition record, with the parent's knowledge), and with the authorities where the law requires, and the notice should explain each; safeguarding records are retained for the periods the guidance sets (long after the child leaves), accident records for the periods the framework and limitation periods require, and the rest for a stated period, with the notice stating the retention and the limit on erasure for records the law requires.

Parents, other carers and who may see what

The notice should say who the setting treats as entitled to information about a child (both parents with parental responsibility unless a court order says otherwise, with the setting not adjudicating family disputes), how other carers and emergency contacts are handled, what happens when parents separate, and how the setting handles requests for a child's record from a parent (a subject access request on the child's behalf, answered within the one-month time limit with the other parent's data redacted); it should cover the rights of access, rectification, erasure, restriction, portability and objection, the means of exercising them, the one-month response period, and the complaint route to the Information Commissioner's Office, and where the fee under the Data Protection (Charges and Information) Regulations 2018 applies, the business registers with the Information Commissioner's Office and the notice says so.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need parents' consent to keep records about their children?

Consent is not needed: the contract, the legal obligations under the framework and legitimate interests cover the records. Consent is for photographs used in marketing and other optional things, and the notice says so.

One parent has asked for everything we hold about their child. Do we give it?

A parent with parental responsibility can make the request on the child's behalf, answered within a month with the other parent's data redacted. The notice explains the process and the setting does not adjudicate family disputes.

How long do we keep a child's records after they leave?

Safeguarding and accident records for the long periods the guidance and limitation periods require; the rest for a stated period. The notice states each and limits erasure for the records the law requires.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a tutor or school
• Employment contract for a nursery practitioner

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.