Nurseries handle personal data all day long: registration forms, contact details, health information, observations and photographs of children. This GDPR training for nursery staff explains what data protection law means for the people who handle that information, in plain terms and with everyday nursery examples.
It gives every member of your team the same clear understanding of what personal data is, how it must be handled and what to do when something goes wrong.
Why GDPR training matters for nursery staff
GDPR covers all the data your setting holds about staff, children and parents or carers. That includes how you obtain consent, take and use photographs, use CCTV, share information and respond to data breaches. The law highlights children’s personal data as needing extra care, and some of what a nursery holds, such as children’s health information, falls into the special categories that need extra protection. Small everyday slips, like an email sent to the wrong parent or a list left on display, can cause real harm to families.
Data protection is not only a job for the manager. Every member of staff has legal obligations under GDPR, and the setting is accountable for showing that each piece of personal data it holds is handled properly. Parents and staff can ask to see the data you hold about them, and the setting must respond within a month. Some breaches have to be reported to the Information Commissioner’s Office (ICO), so staff need to recognise a breach and report it quickly.
What’s in the course
- What GDPR covers in a nurseryPersonal data, consent, photography, CCTV, processing, individuals’ rights and data breaches.
- Types of personal dataEveryday personal data, sensitive data and special category data, and why children’s data needs extra care.
- The six data questionsThe simple checks to apply to every piece of personal data your setting holds.
- Consent and privacy informationWhy consent must be opt-in, and what parents and carers must be told about their data.
- Individuals’ rights and subject access requestsThe right to be informed, the right of access, time limits and how to prepare.
- Data breachesWhat counts as a breach, when it must be reported and why procedures for detecting and reporting matter.
- Reviewing and protecting dataInformation audits, mapping how data moves around the setting and assessing the risks.
- Assessment10 questions. Pass mark 80%. Resit as many times as you need.
What you’ll learn
- What counts as personal data in a nursery, from names, photos and email addresses to next of kin and contact numbers
- Which data needs extra protection, such as health information, racial or ethnic origin, biometrics and criminal records and disclosures
- The six questions every piece of data must pass: processed lawfully and transparently, collected for a clear purpose, limited to what is needed, accurate and up to date, kept only as long as needed, and kept securely
- Why consent has to be opt-in rather than opt-out
- What parents and carers must be told: what data you hold and why, who you share it with, how long you keep it, their rights including the right to complain, and how to contact you
- That privacy information must be clear and in plain language, particularly when it is written for a child
- How subject access requests work: usually free, can be made by email, and answered within a month
- How to judge whether a breach must be reported, using examples such as lost customer details compared with a lost staff phone list
Who this course is for
- Practitioners who write observations, take photographs and talk to parents every day
- Administrators and office staff who manage registration forms and records
- New starters, as part of induction
- Every member of the team who handles or can access personal data
How it works
- OnlineStudy on any device and pick up where you left off.
- Interactive moduleShort slides and activities you work through at your own pace.
- 10-question assessmentPass mark 80%. Resit as many times as you need.
- CertificateIssued when you pass. NFAQ accredited.
Training your team
One careless email can undo a lot of careful policy work, so this course is best taken by everyone who handles personal data. Choose the number of learners at checkout, with group rates from 3 learners, or get it as part of the Training Portal for £5 per learner per month. Managers leading on compliance should also look at GDPR for Managers, and Mobile Phones, Cameras and Smart Devices in the Setting is a good companion course.
Frequently asked questions
What counts as personal data in a nursery?
Names, photos, email addresses, next of kin and phone numbers are all personal data. Health information, ethnic origin, biometrics and criminal records and disclosures need extra protection, and so does any data about children.
Does the course cover photographs of children?
Yes. Photographs are personal data, and the course covers photography and consent as part of what GDPR means for a nursery. The lesson also links to the ICO’s guidance on photos taken in schools and nurseries.
What should I do if I send information to the wrong parent?
Tell your manager straight away. Not every breach has to be reported to the ICO, as it depends on the risk to the people affected, so your manager needs the facts quickly to decide. The downloadable data slip report form takes you through the first steps.
How quickly must a subject access request be answered?
Within one month, with an extension possible for particularly complex requests. Requests can be made electronically, such as by email, and there is normally no charge.
Is this course suitable for managers?
It gives managers the same grounding as their team. If you lead on data protection for your setting, take GDPR for Managers as well.
What happens if I don’t pass the assessment?
You can resit it as many times as you need until you pass. Your certificate is issued as soon as you reach the 80% pass mark.
