Nursery privacy notice and GDPR
Short answer: under UK GDPR, a nursery must tell parents, in clear language when it collects their data, who it is, what it collects, why and on what lawful basis, who it shares it with, how long it keeps it, and their rights, including complaining to the ICO. Since 19 June 2026 you must also have a clear way to make a data protection complaint and acknowledge complaints within 30 days. Most nurseries also pay the ICO fee: £52 a year for small settings.
Updated 4 November 2026, checked against ICO guidance and the EYFS framework in force from 1 September 2026. For the UK; EYFS points are England only. A guide, not legal advice.
What your privacy notice must include
| Section | What to say |
|---|---|
| Who you are | Your setting’s legal name, address and contact details, and your data protection officer’s details if you have one. |
| What you collect | For children: name, date of birth, address, parents and who has parental responsibility, emergency contacts, health, allergies, dietary needs, SEND, learning records, photos, attendance. For parents: contact details, payment and funding eligibility details. |
| Why, and your lawful basis | For example legal obligation (EYFS records, funding claims), contract (your childcare agreement), vital interests (medical emergencies), consent (photos for marketing) or legitimate interests. Health and SEND information is special category data and needs an extra condition too. |
| Who you share it with | Your local authority (funded hours and early years data returns, some of which goes to DfE), Ofsted, health professionals, schools when a child moves on, children’s social care and the police where there’s a safeguarding concern, and suppliers such as your parent app or payroll provider. |
| Transfers abroad | Whether any supplier stores data outside the UK, for example a learning journal app, and how it’s protected. |
| How long you keep it | Your retention periods, or how you decide them. The EYFS says children’s records must be kept for a reasonable period after they leave (3.98). |
| Parents’ rights | Access, correction, erasure, restriction, objection and data portability where they apply, and the right to withdraw consent at any time. |
| How to complain | How to complain to you about the use of personal data, and the right to complain to the ICO. |
| Whether they have to give it | Which information parents must give (for example emergency contacts) and what happens if they don’t. |
| Automated decisions | Usually none in a nursery. Say so. |
Write it for parents, not lawyers: short sections, plain words, and examples from your setting. Most nurseries need separate notices for parents and children, staff and job applicants, plus a short notice for anyone filling in your website’s enquiry form.
What changed in 2026
- Complaints duty. From 19 June 2026 every organisation must make it easy to raise a data protection complaint (for example with an online form), acknowledge it within 30 days, investigate it and tell the person the outcome. Add this to your privacy notice and your complaints procedure.
- The Data (Use and Access) Act 2025 is now fully in force. Most of it clarifies existing rules; check your notice still describes your lawful bases accurately.
- New EYFS framework. If your notice quotes the EYFS, update it to the frameworks in force from 1 September 2026.
What the EYFS says about records
- Keep records and share accurate information with parents, other professionals, the police, social services and Ofsted as appropriate (3.95).
- Keep records easy to access but secure, available only to people with a right or professional need to see them, and know your data protection duties (3.96).
- Make sure all staff understand children’s privacy and confidentiality, and give parents access to their child’s records unless an exemption applies (3.97).
- Keep children’s records for a reasonable period after they leave (3.98).
The ICO fee
| Tier | Who | Fee a year |
|---|---|---|
| 1 | Turnover up to £632,000, or no more than 10 staff. All charities. | £52 |
| 2 | Turnover up to £36 million, or no more than 250 staff | £78 |
| 3 | Everyone else | £3,763 |
Part-time staff count as one each. Childminders usually fall in tier 1. Use the ICO’s self-assessment to check whether you’re exempt.
Photos, apps and your website
- Photos online: ask for clear, separate consent for your website and social media, make it easy to withdraw, and keep a list staff can check. No photos of sleeping children.
- Parent apps: name the app in your notice, check where it stores data, and make sure your contract with it covers data protection.
- Your website: link the privacy notice from every page and from each form. If you use analytics or advertising cookies, you need consent for those.
- Phones and cameras: your safeguarding policy must say how devices that take and share images are used (EYFS 3.6). See the EYFS policies list.
A privacy page is also one of the things our free website checker looks for.
Questions
Does a nursery need a privacy notice?
Yes. Under UK GDPR, anyone collecting personal data must tell people what they collect, why, who it’s shared with, how long it’s kept and what their rights are, at the time it’s collected. For a nursery that means parents, children, staff and job applicants.
Do nurseries have to pay the ICO fee?
Most do. The data protection fee is £52 a year for organisations with a turnover up to £632,000 or no more than 10 staff, £78 for up to £36 million or 250 staff, and £3,763 above that. Charities pay the £52 tier. Some organisations are exempt: check the ICO’s self-assessment.
What changed in data protection law in 2026?
All provisions of the Data (Use and Access) Act 2025 were in force by 19 June 2026. One that affects every nursery: you must give people a clear way to make a data protection complaint, acknowledge it within 30 days, investigate it and tell them the outcome. Your privacy notice should explain how.
Can a nursery share information without consent?
Yes, where there’s another lawful basis. Safeguarding concerns must be shared with children’s social care and, in an emergency, the police (EYFS 3.9), and data protection law doesn’t stop you doing that. Funding claims to the local authority rely on legal obligation, not consent.
Do parents have to consent to photos?
For photos used on your website, social media or in marketing, consent is the usual basis, and parents can withdraw it at any time. Photos in a child’s learning record usually rely on a different basis. Never show sleeping children or anything that identifies a child’s location online.
Can parents see their child’s records?
Yes. EYFS paragraph 3.97 says parents must be given access to all records about their child unless a Data Protection Act exemption applies, and they also have the UK GDPR right of access.
Where should the privacy notice go?
On your website, linked from every page footer and from any form that collects personal data, such as your enquiry or waiting list form. Give a copy, or the link, in your registration pack too.
Sources
- The right to be informed, ICO
- Guide to the data protection fee, ICO
- New data protection complaints law now in force, ICO, 23 June 2026
- The Data (Use and Access) Act 2025: how does this affect me?, ICO, updated 19 June 2026
- Information sharing advice for safeguarding practitioners, DfE
- EYFS framework for group and school-based providers, dated 13 July 2026, paragraphs 3.6, 3.9 and 3.95 to 3.98
More guides: all our guides for nurseries, childminders and schools.
Is your privacy notice on your website?
Every website we build includes a privacy page linked from every page and every form. Send us your setting’s name and we’ll check your current site within two working days. Free, and no sales call unless you ask for one.
Get a free website check