Access, Storage and Retention of Records Policy

At Winston’s Place Day Nursery, we have an open access policy in relation to accessing information about the nursery and parents’ own children. This policy is subject to the laws relating to data protection and document retention and should be used in conjunction with the Data protection and confidentiality policy and the GDPR privacy notice.

Parents are welcome to view the policies and procedures of the nursery, which govern the way in which the nursery operates. All nursery policies are available to view on our website and may also be accessed at any time during nursery opening hours by requesting them from the Nursery Manager. The Nursery Manager, or another relevant member of staff, will explain any policies and procedures to parents and carers, or use other appropriate methods where necessary, to endure they are fully understood.

Parents are also welcome to see and contribute to all the records that are kept on their child. However, we must adhere to data protection laws and, where relevant, any guidance from the relevant agencies for child protection.

The EYFS Statutory Framework 2025 states that “providers must maintain records, obtain and share relevant information (with parents and carers, other professionals working with the child, the police, social services and Ofsted or their CMA, as appropriate). This is to ensure their setting is safe and efficiently managed, and the needs of all children are met”.

As we hold personal information about staff and families, we are registered under data protection law with the Information Commissioner’s Office. A copy of the certificate can be viewed in the Management Office or HR Office. All parent, child and staff information is stored securely according to the requirements of data protection registration, including details, permissions, certificates and photographic images.

“Confidential information and records about staff and children must be held securely and only accessible and available to those who have a right or professional need to see them.” (EYFS Statutory Framework 2025).

We will ensure that staff understand the need to protect the privacy of the children in their care as well as the legal requirements that exist to ensure that information relating to the child is handled in a way that ensures confidentiality.

At Winston’s Place we “ensure that all staff understand the need to protect the privacy of the children in their care, as well the legal requirements that exist to ensure that information relating to the child is handled in a way that ensures confidentiality.” (EYFS Statutory Framework 2025).

Any personal data breach will be managed in line with our Data Protection and Confidentiality Policy. Where required, breaches will be reported to the Information Commissioner’s Office within 72 hours and, where necessary, affected individuals will be informed.

We are required under legislation to keep certain records about children, parents and also staff members for a set amount of time. Below is a brief overview of the information we keep and for how long. This policy should be used in conjunction with the Data protection and confidentiality policy and the GDPR privacy notice.

Children’s records: “Records relating to individual children must be retained for a reasonable period of time after they have left the provision” (EYFS Statutory Framework 2025). We follow the Local Authority procedure which states they should be kept until the child is legally classed as an adult.

Records relating to individual children e.g. care plans, speech and language referral forms: Where appropriate, relevant records will be passed to the child’s next school or setting to support a smooth transition, in line with Local Authority procedures for sharing confidential and sensitive information

Copies will be kept for a reasonable period. We follow the Local Authority procedure which states they should be kept until the child is legally classed as an adult.

Accidents and pre-existing injuries: If relevant to child protection we will keep these until the child reaches 25 years old.

Safeguarding records and cause for concern forms: Copies of relevant records will be securely shared with the child’s new educational establishment, for example their school, in line with Local Authority guidance and data retention requirements. If the nursery is not informed of the child’s onward placement, records will be retained until the child reaches the age of 25.

Records of any reportable death, injury, disease or dangerous occurrence (for children): As these incidents could result in potential negligence claims, or evolve into a more serious health condition, we keep records until the child reaches the age of 21 years and 3 months.

Records of any reportable death, injury, disease or dangerous occurrence (for staff): 3 years.

Type of accidents including fractures, broken limbs, serious head injuries or where the child is hospitalised: Until the child reaches the age of 21 years and 3 months.

Information and assessments about individual children are either given to parents when the child leaves or to the next setting or school that the child moves to (with parents’ permission).

Personnel files and training records (including disciplinary records and working time records): 7 years.
Visitor Signing in book: Up to 24 years as part of the child protection trail.

Nursery records and documentation that are not required to be kept are deleted or destroyed in line with the current data protection laws and our GDPR privacy notice which can be found in the Policies and Procedures File.

Paper records are securely shredded when no longer required. Electronic records are permanently deleted from systems and backups in accordance with our retention schedule.

If parents have a specific deletion or retention request regarding any data that we hold, they must raise a query in writing and we will respond formally to their request.

Parents have the right to request access to personal data held about them of their child through a Subject Access Request. Requests must be made in writing. We will respond within one calendar month in accordance with data protection law. Information relating to third parties may be redacted where appropriate.

Requests for deletion will be considered in line with data protection law. Where we are required by law or safeguarding guidance to retain information, we may lawfully refuse a deletion request and will explain the reasons in writing.

Digital records, including photographs and online learning journals, are stored on password-protected systems with access restricted to authorised staff only.