A childminder's privacy notice must say who you are, what personal data you hold about children and parents, why you hold it and your lawful basis, who you share it with (such as Ofsted or the local authority), how long you keep it, parents' rights, and how to complain to the ICO. AI can draft plain wording, but you must check every claim.
The step most people skip is the reverse check: after the draft is written, compare each sentence with what you really do. A notice that says "we delete records after one year" while your cupboard holds ten years of registers is worse than no notice, because it is a promise you have broken in writing. The workflow below drafts from facts you supply, then tests the draft against those facts.
What the notice has to contain
Data protection law (the UK GDPR and the Data Protection Act 2018) requires you to give people information about how you use their data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and the law singles out information aimed at children for extra care. For a childminder that means a short document given to parents before or when the child starts, and again whenever something material changes. The early years framework itself points childminders to their responsibilities under data protection law (paragraph 3.95) and says parents must be given access to all records about their child, unless an exemption applies (paragraph 3.96). The notice is where you explain how that works.
These are the headings the ICO's right-to-be-informed guidance expects you to cover, translated into childminder terms. The ICO marks that guidance as under review after the Data (Use and Access) Act, so open the current version before you finalise.
- Who you are. Your name, trading name if any, and how parents contact you about data.
- What you hold. Child details, parent and emergency contact details, health and allergy information, accident and medicine records, attendance, learning observations, photographs, payment records, complaints.
- Why, and the lawful basis. One basis for each purpose, not one for everything (next section).
- Who you share it with. Parents, other professionals working with the child, the local authority, Ofsted or your agency, the police or social services where required, your accountant, your insurer, and any software or AI supplier who processes data for you.
- How long you keep it. The framework leaves the retention period for children's records to you (paragraph 3.97 and its footnote), so this is your own stated decision. If you can't give a fixed period, the ICO says you must explain the criteria you use to decide.
- Whether parents have to give it. Say which details you need under the contract or the framework (emergency contacts, allergies) and what happens if a parent won't provide them, for example that you can't offer a place.
- Parents' rights. To see the data, to have mistakes corrected, in some cases to have data erased, to restrict or object to its use, and to complain. The right to object has to be stated clearly and separately from the rest. Where you rely on consent (photographs, say), add that parents can withdraw it at any time and how.
- How to complain. To you first, and to the ICO if unresolved. Since June 2026 the law has required you to make it easy for parents to complain to you (its example is a complaint form that can be filled in online or by other means) and to acknowledge a data protection complaint within 30 days, so say how to reach you and what happens next.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowLawful bases in a childminding setting
Each purpose needs its own lawful basis. These are the ones that usually apply, with an example of each. Treat this as a starting map, and check the ICO's lawful basis guidance before you finalise, because health information is a special category and needs an extra condition on top of the basis.
| Purpose | Likely basis | Note for the notice |
|---|---|---|
| Contract, invoices, attendance for billing | Contract with the parent | Say it is needed to provide and charge for care |
| Required records (attendance, accidents, medicines, complaints) | Legal obligation, because the early years framework is statutory | Cite the early years framework in plain words |
| Sharing with Ofsted, the local authority, safeguarding agencies | Legal obligation | Say you may have to share without asking, where the law or a child's safety requires it |
| Photographs for social media or a website | Consent | Make it optional, separate from the contract, and easy to withdraw |
| Emergency contacts | Legitimate interests or vital interests, depending on the use | Explain that you contact them if a child is ill or not collected |
One refinement: the notice shouldn't read like a legal argument. Name the basis once, then say what it means for the parent in a sentence. "We need your child's allergy details to keep them safe, and the early years framework requires us to keep records of medicines and accidents" says more to a parent than the Article number.
Step 1: write down what you actually hold
Before opening any AI tool, spend fifteen minutes listing your real data, because the draft is only as accurate as this list. A simple table does it. The one below is illustrative, for a childminder with an assistant who uses a registration app and a phone for photographs.
| Data | Where it lives | Who sees it | How long |
|---|---|---|---|
| Child name, date of birth, parents' details | Registration form, paper folder and spreadsheet | Me, my assistant | Decided period after leaving |
| Allergies and medical needs | Registration form; notice on kitchen wall | Me, my assistant, emergency services if needed | As above |
| Accident and medicine records | Accident book, medicine folder | Me, my assistant, parents, Ofsted on request | Longest period, checked with my insurer |
| Photographs and learning notes | Phone, then diary app | Me, parents, app supplier | Until the child leaves, then returned or deleted |
| Invoices and payments | Banking app, spreadsheet | Me, my accountant | As my accountant advises |
Two columns catch most problems. "Where it lives" reveals the places data hides (an old phone, a shared photo album). "Who sees it" is where AI tools and apps enter the picture: if a diary app or a chatbot processes any of it, they are a recipient and belong in the notice.
Step 2: draft with AI from the list, not from a template
Paste the table (it holds no real child's details), plus the list of lawful bases above, and ask for a notice a parent can read in three minutes. Giving the model your facts stops it inventing a generic notice full of promises that don't apply to you.
Write a privacy notice for parents from a childminder, in plain British English, aimed at a reading age of about 12. It must be under 700 words.
Use ONLY the facts in the table below. Do not add any practice, supplier, retention period or right that is not in my table or my list of lawful bases. Where information is missing, insert [CHECK: what is needed] instead of guessing.
Use these headings: Who I am; What I keep; Why I keep it; Who I share it with; How long I keep it; Your rights; How to complain.
For each purpose, give the lawful basis in one plain sentence.
[table and list here]Illustrative extract of what comes back for the "How long" section: "Records about your child are kept for [CHECK: your period] after they leave. Accident and medicine records are kept for [CHECK: insurer's period]. Invoices are kept as long as my accountant tells me I must." The placeholders are the point: the model has shown you what you still have to decide instead of hiding it.
Step 3: check the draft against reality
Run the reverse check in a fresh chat so the model isn't defending its own draft. Paste the finished notice and your table, and ask for contradictions.
Compare this privacy notice with this table of what I actually hold. List: (1) anything the notice promises that the table does not support, (2) any data or recipient in the table that the notice does not mention, (3) any sentence a parent might misunderstand, with a simpler rewrite. Do not rewrite the whole notice.A typical finding: the notice says "your child's photographs are only seen by me and you", while the table shows a diary app supplier. You either remove the app or change the sentence. A second typical finding: the notice says parents can ask for erasure at any time, which overstates the position for records you must keep by law. Reword to "you can ask us to delete data we no longer need; some records we must keep".
Step 4: the ICO checks only you can do
AI can't tell you whether you must register or pay, and it shouldn't guess. Do these yourself, and write the date next to each.
- Data protection fee. The ICO says organisations that use personal information, sole traders included, need to pay a data protection fee unless they are exempt. Its online self-assessment takes about ten minutes and tells you whether you must pay and how much. The tier depends on staff numbers and turnover, and a childminder who has to pay will normally fall into the lowest tier, for micro organisations. Keep a screenshot of your answers and the result, whichever way it comes out.
- Your own name and contact details. Make sure the notice shows the same details as your registration and contract.
- Right to complain. Check the ICO's current wording for how to complain and use it.
- Annual review date. Put a reminder in your diary to re-read the notice each year and after any change of supplier or practice.
The fee amounts change, so this tutorial doesn't quote one. Use the figure on the ICO site on the day you check, and note that the ICO has offered a small discount for paying by direct debit.
Plain-English before and after
Legal wording reads as if it wasn't written for a parent at the door at 8am. Here are two before-and-after rewrites, illustrative, that show what the "reading age 12" instruction should produce.
- Before: "Personal data may be disclosed to relevant third parties where there is a statutory obligation to do so." After: "I may have to share information about your child with Ofsted, the local authority or the police if the law or your child's safety requires it. I'll tell you first when I'm allowed to."
- Before: "Data subjects have the right to object to processing based on legitimate interests." After: "If you're unhappy with how I use some information, tell me. I'll stop using it that way unless I have a strong reason to carry on, and I'll explain the reason."
The first "after" contains a promise ("I'll tell you first when I'm allowed to") that you must be ready to keep, so check each rewritten sentence against your practice, not just against readability.
Special cases to write in by hand
Photographs and social media
Don't bury photograph consent in the contract. A separate tick-box form with options (learning diary only, parents' group only, my public page) lets parents say yes to one and no to another, and makes withdrawal simple. Add one sentence to the notice: "You can change your mind at any time by telling me, and I'll remove photographs from anything I control."
Allergies and health information
Health details are a special category of data. They are the information you most need to share quickly in an emergency, and the most sensitive if they leak. Say who sees them, say they are not sent to anyone else, and keep any laminated allergy notice out of view of people who don't need it. The paperwork checklist in which records a childminder must keep shows where these details sit in your records.
Separated parents
The framework requires you to record who has parental responsibility and which parent the child normally lives with. Your notice should say that information is shared with a parent according to their legal entitlements, and that you may ask for documents if there is a dispute. Take advice if a situation becomes contested; don't let a chatbot decide.
Using AI yourself
If you use AI for anything that touches children's information, the notice should say so in one honest sentence, with the rule you follow. For example: "I may use an AI writing tool to tidy my own wording. I never put children's names or details into it." If your answer to that second sentence isn't true, change the practice. Using AI with children's data safely covers the safeguards, and what to check in a tool's privacy terms covers the supplier side.
How to test that parents understand it
Print the final notice and ask one parent, ideally one who doesn't enjoy paperwork, to read it and tell you in their own words what you do with their child's photographs and how long you keep their records. If they can't answer in under a minute, the notice is too long or too vague. Edit and test with another parent next term. An honest ten-minute reading session is more valuable than a polished document no one has read.
A model closing paragraph to adapt
End the notice on rights and contact. For instance: "You can ask to see what I hold about your child, ask me to correct it, or ask me to stop using it in a particular way. Email or message me and I'll reply within a month. If you're not happy with my reply, you can complain to the ICO, whose details are on its website. I review this notice every year and will give you a new copy whenever it changes." The ICO says organisations usually have one month to respond to a request for a copy of someone's information; check its current guidance on when that can be extended before you promise it.
A filled-in extract you can compare with your own
This illustrative extract shows the register to aim for. It is not a complete notice and the retention periods are placeholders, because those are decisions only you can make.
What I keep. Your child's name, date of birth and your contact details. Who can collect them. Any allergies or health needs I need to keep them safe. A daily record of when they arrive and leave. Records of accidents, medicine and any complaints. Notes and photographs of what they've been doing. Invoices and payments.
Why. To look after your child safely and to charge for it (that is our contract). To keep the records the early years framework requires. To show those records to Ofsted if they ask. If you've agreed to it, to share photographs with other parents or on my page.
How long. [Your period] after your child leaves, except accident and medicine records, which I keep for [your insurer's period].
Notice what is missing: Latin terms, article numbers and the word "pursuant". Notice also what is present: a plain reason beside every item. If your AI draft is longer and vaguer than this, ask for a cut, not for more.
Handling a request from a parent to see their child's records
The framework says parents must be given access to all records about their child, provided no relevant exemption under the Data Protection Act applies (paragraph 3.96). Your notice promises this, so have a routine ready. An illustrative sequence: a parent emails asking for "everything you hold on my daughter". You note the date, confirm you've received it, and collect the register entries, accident and medicine records, learning notes and invoices. You check whether any record includes information about another child or a safeguarding concern; these may need redacting or withholding, and that is a decision for you, taken with advice from your local safeguarding contact or the ICO's guidance, not for an AI tool. You send the records securely and keep a note of what was sent and when.
AI can help with one narrow part: turning your list of record types into a checklist so nothing is forgotten. It must never be given the records themselves to redact. A model that "removes names" from a document will sometimes miss one, and a missed name is a disclosure.
Three ways a childminder's notice goes wrong
- Copying a nursery's notice. A nursery has staff, committees and a larger set of suppliers. Copied wording tells parents about processes you don't run, and omits the ones you do. The fix is the table in step 1.
- Promising deletion on a date and never doing it. A sensible control is a yearly diary entry, "delete expired records", with a note of what was deleted. If you can't commit to it, choose a longer period you will honour.
- Treating the notice as the same thing as consent. A notice informs. Consent is a separate, optional agreement for optional things. If a parent refuses photographs, the child's place can't depend on it.
Where it fits with your other paperwork
The notice is one page in a set. The contract with parents is drafted and checked in the childminder contract tutorial; the records themselves are listed in the childminder paperwork checklist linked above; and an early years AI policy covers what staff may and may not do with AI. Keeping the three consistent matters more than polishing any one: if the notice says one thing and the policy another, an inspector or a parent will notice the gap before you do.
Keeping the notice true over the year
A privacy notice drifts the moment you change something: a new app for sharing photos, a new assistant, an accountant switching software. Add a line to your monthly routine: "has anything changed in what I hold, where it lives or who sees it?" If yes, edit the table first, rerun the reverse check, and send parents the new version. A written AI usage policy gives you a single reference for the AI part, so the notice only needs to summarise it.
Privacy notice questions childminders ask
Do I need a privacy notice if I only have a few children?
Yes. Data protection law applies to how you handle each family's information whatever the number of children. The notice is how you tell parents what you hold, why, who sees it and for how long. A short, honest one-page notice is enough for a small setting.
Can I use consent as my lawful basis for everything?
Usually not. Much of what you hold is needed to deliver the contract with parents or to meet requirements in the early years framework, so those are different bases. Consent suits optional extras such as photographs for social media, and it must be freely given and easy to withdraw.
Do I need to register with the ICO?
Most organisations that handle personal data must pay a data protection fee unless an exemption applies. Don't assume either way: use the ICO's own self-assessment on its website, keep a screenshot of the result, and diarise the renewal date.
Can I paste my draft notice into an AI tool?
A privacy notice describes your practice in general terms, so it contains no child's details and is safe to draft with AI. Never paste real records into the same chat while you work on it. Use placeholders for your name and contact details if you prefer.
Further reads
- How Nurseries Use AI to Write Daily Reports for Parents — Photographs and daily notes for parents, and what to keep out of prompts.
- How to Classify Business Data Before Using AI Tools — Sorts the data you hold into what may go near AI and what may not.
- Is It Safe to Put Customer Data Into ChatGPT? — The wider question of what happens to pasted data.
- Nursery Staff Training: A One-Hour AI Briefing on Children's Data — A briefing for assistants who handle children's data.
- How to Mention AI Use in Client Contracts and Proposals — How to state your AI use clearly in contracts.
- Telling Patients You Use AI Note-Taking: Consent Wording That Works — Consent wording examples from a sister setting that handles sensitive data.
- Doula Contract Template: On-Call Terms, AI Draft, Lawyer Check — A doula contract walked clause by clause, with sample wording for on-call terms and cancellation, an AI drafting prompt, and a lawyer-check step.
- AI for Private Schools: Admissions, Fees and Parent Communication — An office-side map of the private school jobs AI can do, from enquiry follow-up and offer letters to fee reminders, and where a person must decide.
- Counselling GDPR: Can You Use AI With Client Information? — A counsellor's step-by-step vetting of any AI tool before client information goes in: basis, contract, location, retention and privacy notice.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: the Early Years Foundation Stage statutory framework for childminders (version in force from 1 September 2026), paragraphs 3.94 to 3.101; the ICO's guidance on what privacy information to provide, its guide to the data protection fee and fee self-assessment, and its public page on subject access requests; UK GDPR Article 12; the Data (Use and Access) Act 2025 provision on complaints to controllers (in force from 19 June 2026).