Nursery Data Protection Policy: Draft and Update It With AI

Map the personal data you hold first, then give that map to an AI tool and ask it to draft the policy, privacy notice and retention schedule from it. Check every clause against the ICO's own guidance, confirm your ICO fee status, and have the manager and staff sign off the final version.

A nursery holds some of the most sensitive data of any small business: children's names, health, allergies, safeguarding notes, photos, and parents' contact and payment details. AI helps with the drafting and the upkeep. It cannot know what you actually do, which is why the data map comes first.

Follow me on Instagram@sagnikteaches

Why the map comes before the policy

Ask an AI tool for "a data protection policy for a nursery" and you receive a polished, plausible document that describes an imaginary nursery. It will mention things you do not do and miss things you do. Staff then sign a policy that does not match practice, which is worse than having no policy, because it creates a written promise you are breaking.

Connect on LinkedInSagnik Bhattacharya

The data map is a plain list of what you hold, why, where, who sees it and how long you keep it. It turns the policy into a description of your real setting. Everything that follows, from lawful bases to the privacy notice, is drafted from it.

Subscribe on YouTube@sagnikteaches

The focus here is the policy and its upkeep. If your question is what children's data may go into an AI tool at all, is it safe to use AI with children's data in a nursery answers it, and the policy below should reflect those rules.

Step 1: build the data map

Spend an hour with the manager and deputy, walking through a child's journey from enquiry to leaving, and a staff member's journey from application to leaving. For each stage, write down what you collect. A table works well. Here is an illustrative extract for a small nursery:

The "kept for" column is deliberately blank. That is the retention schedule, step 3. Extend the map to include every system and supplier: the nursery software, email, the payment provider, the photo app, the accountant, any cloud storage. Each is a place where data lives, and each supplier that processes it for you needs to be on the list. Ask what each supplier does with the data and check they have appropriate terms.

Step 2: lawful bases, decided by a person

Data protection law requires a lawful basis for each use of personal data, and extra conditions for sensitive categories such as health. Your map's "why we hold it" column is the raw material. The choice of basis is a judgement that belongs to the manager, informed by the regulator's guidance and an adviser where needed.

In outline, and to be checked against the ICO's current guidance rather than taken from this page: running the placement and invoicing often rests on contract; records the nursery must keep by law rest on legal obligation; optional uses such as photos on social media or newsletters usually need consent, which the ICO describes as freely given, specific, informed and unambiguous, and which must be as easy to withdraw as to give. Health and safeguarding information is special category data, so the ICO says you need both a lawful basis and an additional condition. Do not rely on "consent" for everything: if a parent has no real choice, the ICO says consent is not freely given and is invalid. The ICO's lawful-basis guide now also lists a "recognised legitimate interest" basis for a short list of pre-approved purposes, added by the Data (Use and Access) Act; check that list before assuming it covers anything you do.

AI can help you not by choosing but by organising. Give it the map and ask it to list, for each row, the questions you must answer. Then answer them yourself. A prompt that works:

Below is a data map for a small nursery. For each row, list the
questions the manager must answer to choose a lawful basis and,
where health or safeguarding data is involved, an additional
condition. Do NOT choose a basis yourself. Put the answers in a table
with columns: row, questions to answer, guidance page to check.
Tell me where you are unsure.

DATA MAP:
[paste the map, no real names or personal data]

The output is a checklist, not a decision. The manager reads the regulator's guidance on lawful bases, fills in the basis per row, and records the reason. Where a row is unclear, such as whether photos in learning journals need consent, mark it for adviser review.

Drafting the policy from the map for a 40-place nursery

Say a nursery of 40 children and 12 staff has a completed map and chosen bases. The manager now asks for a first draft. The prompt (illustrative):

Draft a data protection policy for a nursery, in plain English, for
staff to read and sign. Use ONLY the information in the data map and
decisions below. Do not describe any system, practice, supplier or
retention period that is not listed. Where something is missing,
write [MISSING: what is needed].

Sections: purpose and scope; roles (data lead: [name/role]);
what we collect and why (from the map); lawful bases (from decisions);
how we keep data safe; sharing and suppliers; retention (from the
schedule); children's and parents' rights and how to ask;
photos and consent; breaches: what staff do in the first hour;
training and review.
Tone: clear, calm, no legal jargon. Staff must be able to follow it.

DATA MAP AND DECISIONS:
[paste]

A typical output opens sensibly and then drifts in one or two places (illustrative): "All staff will use encrypted devices at all times." The nursery uses an unencrypted shared tablet in the baby room. The sentence is something a regulator could quote against you. The manager changes it to what is true and adds an action: "Shared tablets are locked with a code and kept in the room cupboard; the manager is moving them to managed devices by [date]." Honesty with a dated action is a better position than a promise you cannot keep.

Another typical drift: a section on "international transfers" that mentions a supplier you do not use. Delete anything that does not match the map.

Time: about two hours for a first draft, once the map exists, including the manager's edit. Starting from nothing takes much longer and usually produces a worse document.

Step 3: the retention schedule

You may keep personal data only as long as you need it, and you must be able to explain how long that is. Fill in the "kept for" column with a period and a reason for each row. The right periods depend on legal requirements, your insurer, the local authority and funding rules, and early years guidance, so do not take figures from an AI answer. Common sources to check include the regulator's guidance on storage limitation, the early years statutory framework, your insurer's requirements for accident and incident records, and published guidance from early years membership bodies. Some records, such as those relating to safeguarding, have special rules, so ask your designated safeguarding lead and adviser.

AI's job here is to turn your decisions into a clean table and a disposal routine. Example output (illustrative), after you have entered your checked periods:

Retention schedule extract
Registration form: [period] after the child leaves. Reason: [reason]. Disposal: secure shredding and deletion from the software, by the manager, each September.

Ask for a yearly disposal checklist: who reviews which records, on what date, how deletion is done and where it is logged. A schedule nobody acts on is paper; the annual clear-out is what makes it real.

Step 4: the privacy notice for parents

The privacy notice tells parents, in clear language, what you do with their and their child's data. It is a separate document from the staff policy, written for the people it concerns. The ICO's list of what privacy information must cover includes your name and contact details, the purposes, the lawful basis, who receives the data, how long you keep it (or the criteria you use to decide), the rights people have, the right to withdraw consent, the right to complain to the regulator, and whether people must provide the data and what happens if they do not. That last item matters for a nursery: some details, such as allergies and emergency contacts, are a condition of taking the place, and the notice should say so plainly.

Ask the AI to turn the map into a parent-facing notice at a reading age of about 12, with short headings such as "What we collect", "Why we need it", "Who sees it", "How long we keep it", "Your rights". Then check it against the regulator's list, item by item. An illustrative before and after: the AI's first line reads "We process personal data in accordance with the legitimate interests of the nursery." After editing: "We use your child's details to look after them safely and to keep you informed. We keep these records for the time set out below." If you do use "legitimate interests" as a basis for something, a person should check that the required balancing assessment has been done.

Give the notice to parents at registration, put it on your website and mention it in your welcome pack.

Step 5: the ICO fee check

The ICO's fee page says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt, and many can rely on an exemption. A nursery holding children's and staff records will usually need to check carefully. There are three tiers, set by the number of staff (counted broadly: employees, workers, office holders and partners, each part-timer as one) and annual turnover; charities that are not exempt pay only the lowest tier. The amounts were last raised in February 2025 and can change again, so do not take a figure from an AI answer. Use the ICO's own online fee self-assessment, record the result and the date, and add a diary entry for the renewal: the ICO warns that a late renewal lets your registration expire and drops you from its public register. Ask your bookkeeper to check that the payment appears in the accounts.

Put the fee reference and renewal date in the policy's admin section so a new manager can find them. If the regulator's page blocks automated tools or your AI cannot read it, that is fine: this is a job to do yourself, in a browser.

Step 6: check the draft against the regulator's guidance

The draft is only as good as your checking. Print the regulator's guidance pages for the topics your policy covers: the principles, lawful basis, special category data, children's data, privacy information, retention, security, breaches and individual rights. Then do two passes.

First, a coverage pass: for each topic, find the paragraph in your policy that deals with it. Gaps get filled. Second, a truth pass: for each statement in the policy, ask "do we do this today?" with the person who does the job. Anything not true is changed to the truth plus a dated action.

You can also use AI as a second pair of eyes, with limits. Paste the draft and ask it to list statements that sound like promises, any terms that are used inconsistently, and any section with no named owner. It is good at that. It is not good at confirming legal accuracy, so do not ask "is this compliant?".

Step 7: sign-off and training

A policy exists in practice only when staff have read, understood and signed it. Do this in a staff meeting rather than by email, so there is a chance to ask questions, and keep a sign-off sheet with name, date and version. Cover the points that staff meet daily: photos and devices, what to do with a lost USB stick or wrong email, who the data lead is, how to handle a parent's request to see records, and the one-hour breach response.

If you would like a ready-made session, a one-hour AI briefing on children's data covers what staff should and should not put into AI tools. Add the same rules to your policy, so the two documents agree. A companion early years AI policy template goes into more detail if you want a stand-alone AI document.

Two examples that show the policy working

A parent asks to see what you hold about their child

People can ask for a copy of the personal data you hold about them or their child. The ICO's guide says you must respond without undue delay and within one month of receiving the request; you can extend by up to two further months if the request is complex or the person has made several, but you must tell them why within the first month. If you genuinely need to ask what they want, the one-month clock pauses until they reply. A policy that says "requests go to the data lead" is not enough. Write a short procedure: log the request on the day it arrives, confirm who is asking and that they are entitled to the information, search every place on the data map, check for other people's information that must be left out, and reply in writing. AI can draft the acknowledgement and the cover letter, for example: "Thank you for your request of [date]. We will reply by [date]. If we need to ask you anything to find the right records, we will contact you before then." It must not do the search or the redaction on real records unless your tools and terms allow it; AI and subject access requests sets out where those limits sit. The data map is what makes the search possible: without it, nobody knows whether the key person also keeps notes in a personal notebook.

Consent wording for photographs

Photos are where nurseries most often ask for consent, so the wording matters. A single tick for "photos" is too blunt. Ask the AI to draft a form with separate choices, then edit it to match your practice (illustrative):

• Photos in your child's own learning journal, shared only with you: yes or no.
• Photos of your child shown on display boards inside the nursery: yes or no.
• Photos in group pictures that other families may see: yes or no.
• Photos on our website or social media: yes or no.

Add a line explaining that they can change their mind at any time by telling the manager, and what you will do when they do. Then check the practice matches the form. If a parent has said no to group pictures, does the key person know? The consent column in the nursery software, a sticker on the register or a photo list in each room all work. A form that nobody can act on is worse than no form.

Review triggers, including the 2026 complaints duty

Policies rot when nobody owns the review. Give the policy a named owner, a version number and a next-review date. Then set triggers for earlier review: a new piece of software, a new type of data (for instance a new app for parents), a change in your suppliers, a breach or near miss, a change in the regulator's guidance, or a change in your own practice.

A change in the law is a trigger too, and 2026 supplied one. The ICO announced that from 19 June 2026 every organisation handling personal data must give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate it appropriately and tell the person the outcome. A nursery policy written before then probably sends data complaints through the general complaints procedure with no data-specific steps. The fix is a short section: how a parent or staff member can complain, who logs it, the 30-day acknowledgement, who investigates, and how the outcome is sent. AI can draft the acknowledgement letter and the log headings from your existing complaints procedure in a few minutes; the manager decides who investigates.

At each review, update the data map first, then ask the AI to compare the old policy with the updated map and list differences. Example prompt: "Here is last year's policy and this year's data map. List every statement in the policy that no longer matches the map, and every item in the map that the policy does not cover." You then fix each item, re-check against the guidance and re-sign.

A realistic mistake, to illustrate the point: a nursery adopts a new parent-messaging app in spring. Nobody updates the map. The policy still says all communication is by email. The privacy notice does not name the app. When a parent asks where their child's photos are stored, the manager cannot answer. A trigger rule, "any new system means a map update before go-live", would have caught it.

Breach readiness: the one-hour routine

Include a short procedure for a data breach, such as a document sent to the wrong parent or a lost tablet. Staff should know to tell the manager straight away, not to try to fix it quietly. The manager records what happened, assesses the risk to the people affected, decides whether it must be reported to the regulator and whether to tell families, and notes what changes will prevent a repeat. The ICO says a reportable breach must be notified to it as soon as possible and, where feasible, within 72 hours of becoming aware of it, even if the full picture is not yet clear, so the procedure must name who decides and how to reach them, including when the manager is away. Keep a breach log even for incidents you decide not to report. A step-by-step version for breaches involving AI tools is in the 72-hour breach checklist.

A one-page breach card, drafted with AI from your procedure and stuck in the staff room, is a good use of it. Keep it to six lines: stop, tell the manager, write down what happened, do not delete anything, wait for instructions, do not contact the parent yourself.

If you would rather map all of this with someone, my AI implementation consultation covers it. The routine above is enough to run on your own: data map, bases, retention, notice, fee check, guidance check, sign-off, annual review.

Questions nurseries ask about data protection policies

Does a nursery need to pay the ICO data protection fee?

Most organisations that process personal data must pay a data protection fee unless an exemption applies, and nurseries normally process children's and staff data. Use the regulator's own self-assessment on its website to confirm whether you must pay and which tier applies, and keep a record of the result.

Can AI write the policy without my data map?

It will produce something that sounds right and describes a generic nursery, not yours. A policy that does not match what you actually collect, share and keep is a liability, because staff will not follow it. Build the data map first, then draft from it.

Which lawful basis covers photos and learning journals?

It depends on the use. Records needed to run the placement and meet legal duties rest on different bases from optional photos shared with other families or on social media, which usually need consent. Decide each one in your data map and check against the regulator's guidance, taking advice if unsure.

How often should the policy be reviewed?

At least once a year and whenever something changes, such as new software, a new type of data, a breach or a change in guidance. Record the review date and version, and make sure every staff member signs the current version.

Further reads

• Tapestry vs Famly for a Small Nursery: Where Does AI Fit? — See how nursery software affects what data you hold.
• Can AI Write a Nursery Self-Evaluation Form From Your Evidence? — Use policy evidence in your self-evaluation.
• Choosing Nursery Software With AI: What to Compare — Check the data protection side before buying software.
• Nursery Ofsted Inspection Checklist: An Evidence Folder With AI — File the policy and sign-offs in your evidence folder.
• How Nurseries Use AI to Write Daily Reports for Parents — Check daily reports against your consent rules.
• Nursery Late Collection Policy: Wording, Fees and Parent Messages With AI — Another parent-facing policy to draft and check.
• After School Club Registration Form: Consents Built With AI — A field-by-field club registration workflow with separate permissions, authorised collector details and a chase sequence for missing forms.
• Childminder Contract: AI First Draft, Solicitor Final Check — An AI first draft of a childminder contract, a plain-English version for parents, and the clause-by-clause list a solicitor should check before use.
• Daycare Incident Reports With AI: Factual, Name-Free Narratives — A facts-only structure for daycare incident reports, an initials rule that keeps names out of AI tools, parent wording and a director sign-off.
• Daycare Inspection Checklist: Prepare Your Records With AI — Build a daycare inspection checklist from your licensing rules, check staff and child records against it with AI, and keep a corrective-action log.
• How to Increase Nursery Occupancy: Open Days, Reviews and AI — Raise nursery occupancy with a measured funnel: open-day plan, same-day visit follow-ups, review replies, funded-hours checks and weekly counts.
• Nursery Fees Policy: Deposits, Late Payment and Holidays With AI — A clause list for a nursery fees policy, a plain-English parent version drafted with AI, and a reminder ladder, checked by a solicitor.
• Nursery Welcome Pack: Letters and Settling-In Guide With AI — What goes in a nursery welcome pack, with prompts for plain-English letters, a settling-in guide, a key person introduction, forms and checked translations.
• Preschool Enrolment Form: Build, Send and Chase Forms With AI — Draft the fields, consent wording and reminder emails with AI, then chase missing documents from a simple tracker that holds no child details in the chat.
• Preschool Parent Handbook: Draft It With AI and Check State Rules — Use AI to outline the handbook and rewrite policies in plain English, then check every section against your licensing authority's own published rules.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: ICO pages on the data protection fee (guide, tiers, self-assessment), lawful basis, valid consent, what privacy information to provide, subject access requests, personal data breaches and the complaints duty in force from 19 June 2026 (read from web.archive.org copies dated September and October 2026, because the live site served a bot check).