Retention Policy for GDPR
The General Data Protection Regulation is an EU law from May 2018. It requires me to share information with you about data retention after you child has left my setting.
Data I retain about you and your child falls into 3 main categories:
-
Safeguarding and Welfare data linked to Ofsted and the Early Years Foundation Stage requirements and the Limitation Act 1980
-
Financial data retained for HMRC purposes
-
Funding data retained for Local Authority purposes
I store data about you and your child in paper format, online (Tapestry), on my computer, iPad and phone.
Safeguarding and Welfare requirements of the EYFS
To comply with the Limitation Act 1980, I keep Accident, Injury and First Aid Records and Medication Administration Records using the legal basis of ‘legal obligation’ until your child is 21 years and 4 months old for insurance requirements.
Attached to the Accident, Injury and First Aid Records and Medication Administration Records I also retain the Parent – Provider contracts, the Child Record Form and Attendance Registers using the legal basis of ‘vital interests’ to provide additional evidence of compliance with the Early Years Foundation Stage 2021 (EYFS).
I keep further data related to Safeguarding and Welfare Requirements in the Early Years Foundation Stage 2021 (EYFS) and the Childcare Register for ‘a reasonable period of time’.. ICO advise is that this data should be kept between Ofsted inspections or within the Ofsted inspection cycle which might be between 3 and 8 years.
Information kept in paper format (documents) will be shredded after the required retention period. Information stored on my computer (Tapestry) will be dust deleted.
Data relating to the Learning and Development requirements of the EYFS
To comply with the EYFS 2021, I keep documents relating to your child’s learning and development, including photos and videos of your child’s progress, activities and experiences.
I use the legal basis of ‘legal obligation’ when recording your child’s learning, development and progress and ‘legitimate interest’ when taking photos of your child, because I believe it is reasonable for me to process this data to provide you with a good quality service and to ensure the best possible outcomes for your child.
I keep the information, including photos online/in paper format. All paper copies will be passed on to you when your child leaves my setting or starts school, whichever comes first.
I use the online learning journey system Tapestry to process data about your child. I will ask you to read and sign my ‘Data Sharing Agreement’.
Financial record keeping
I keep documentation including your name and payment record for HMRC using the legal basis of ‘legal obligation’. I keep this information online/in paper format and are required to retain this information by HMRC for 6 years after which time they are deleted.
You will be asked to read and sign a Data Sharing Agreement in relation to documents shared with my accountant Elson Geaves and Elson Geaves will provide you with a written Privacy Notice.
Data relating to Local Authority funding forms
I keep documentation including your name, address, national insurance number, date of birth and tracking data for Local Authority funding forms using the legal basis of ‘contractual necessity’. This data is held in paper format and I am required to retain these forms by the Local Authority, after which time they are shredded.
Personal data
I have been advised by the Information Commissioners Office that it is reasonable to keep a record of your mobile phone number on my mobile phone and your email address on my computer email provider for up to 1 financial year after your child leaves my setting, so I can contact you if necessary to clarify, for example, accounts information or details relating to your Tax Credits claim (if relevant). The data will be deleted after this period.
If I close my setting or on my retirement, I will keep documentation for as long as legally required by the purpose for which it was collected. There is no absolute duty to encrypt data stored online but I will keep it as securely as possible during the retention period (see Article 32 of GDPR for more information).
You have the right to ask for information held about you and your child to be withdrawn. This is called the ‘right to erasure’ in GDPR. However, if I need to keep information because it is legally required then exceptions to the ‘right to erasure’ apply. I will make a decision about each erasure request individually – please speak to me for more information.