Nurseries hold a lot of personal information: children’s names, photos and health details, family contacts, staff records and disclosures. This GDPR training for nursery managers explains what data protection law asks of a childcare setting and takes you through the practical steps to reach compliance, from an information audit and a data flow map to consent forms, privacy notices, subject access requests and breach procedures.
The course is written for the person who leads on data protection. It works through what GDPR means for settings, then turns it into a set of next steps you can plan around: staff training, a named data protection lead, a data audit, a data flow diagram, a policy review and confirming marketing consent.
Why GDPR training matters for nursery managers
Under GDPR, accountability sits with the setting. You must be able to prove that you comply with the data protection principles, and effective policies and procedures are how you show it. Privacy notices must set out your legal basis for processing data, how long you keep it and each person’s right to complain to the Information Commissioner’s Office (ICO).
Parents and staff also have rights over their data. A subject access request must be answered within one month, and your procedures should cover how you would delete personal data or provide it electronically. Breaches likely to cause someone harm must be reported to the ICO, and failing to report a breach can lead to a fine on top of any fine for the breach itself.
What’s in the course
- What GDPR coversConsent, photography, CCTV, individuals’ rights, how data is processed and data breaches.
- Accountability and privacy noticesProving compliance, what a privacy notice must include, and writing information children can understand.
- Your information auditWhat staff and children’s data you hold, where it came from and who you share it with, and the different types of data.
- Data flow mappingMapping internal and external flows of data to spot unintended uses and plan for future ones.
- ConsentMoving to opt-in consent, reviewing your consent forms and checking that everything you collect is relevant.
- Subject access and individuals’ rightsResponding within one month, template letters, staff training, data portability and deleting data.
- Data breachesProcedures for detecting, reporting and investigating breaches, and the cost of getting it wrong.
- Your next stepsData protection by design, a data protection lead, and a clear plan for reaching compliance.
- Assessment10 questions. Pass mark 80%. Resit as many times as you need.
What you’ll learn
- What accountability means in practice: being able to prove compliance through effective policies and procedures
- What your privacy notice must include, including your legal basis, retention periods and the right to complain to the ICO
- How to run an information audit of the staff and children’s data you hold, where it came from and who you share it with
- The difference between everyday personal data, such as names, photos and contact numbers, and special category data, such as health, ethnic origin, biometrics, and criminal records and disclosures
- Why consent must be a positive opt-in, never inferred from silence, inactivity or pre-ticked boxes, and why you must be able to show it was given
- How to handle a subject access request within one month, with updated procedures, template response letters and trained staff
- Why data portability means being able to provide data in a commonly used electronic format
- How to put procedures in place for detecting, reporting and investigating a personal data breach
Who this course is for
- Nursery managers, owners and deputies responsible for data protection
- The person named as your setting’s data protection lead
- Administrators who manage enrolment forms, consents and records
- Managers reviewing policies, privacy notices and consent forms
How it works
- OnlineStudy on any device and pick up where you left off.
- Interactive moduleShort slides you work through at your own pace, with checklists to use in your setting.
- 10-question assessmentPass mark 80%. Resit as many times as you need.
- CertificateIssued when you pass. NFAQ accredited.
Training your team
Staff training is one of the first next steps the course recommends, because everyone in the setting handles personal data. Choose the number of learners at checkout, with group rates from 3 learners, or get it as part of the Training Portal for £5 per learner per month. For the wider team, see GDPR for Staff, and for photos and devices, Mobile Phones, Cameras and Smart Devices in the Setting.
Frequently asked questions
How is this different from GDPR for Staff?
This course is for the people who lead on compliance. It covers the audit, data flow mapping, privacy notices, consent, subject access and breach procedures. GDPR for Staff is the companion course for team members who need general awareness.
How long do we have to answer a subject access request?
One month. The course covers updating your procedures, preparing template response letters and training staff to respond. A downloadable procedure and log help you handle each request within the deadline and evidence it from receipt to response.
What counts as valid consent?
Consent has to be a positive indication of agreement. It cannot be inferred from silence, inactivity or pre-ticked boxes, and you must be able to show that it was given. The course suggests reviewing your consent forms and checking that everything you collect is relevant.
Do all data breaches have to be reported to the ICO?
Breaches that are likely to cause someone harm must be reported. The course links to the ICO’s self-assessment to help you decide, and includes a step-by-step breach response checklist to keep with your data protection policy.
What practical tools are included?
A data audit and breach response checklist, a data flow map and privacy notice check, and a subject access request procedure and log, plus links to the ICO’s guidance on privacy notices, right of access and reporting a breach.
What happens if I don’t pass the assessment?
You can resit it as many times as you need until you pass. Your certificate is issued as soon as you reach the 80% pass mark.
