Child protection file transfer

The rule: what KCSIE 2026 says about moving the file

The requirement is in two places in Keeping children safe in education 2026 (KCSIE 2026), the Department for Education's statutory guidance for schools and colleges in England. Paragraph 150 in Part two says: "Where children leave the school or college, the designated safeguarding lead (or a deputy) should ensure their child protection file is transferred to the new school or college as soon as possible, and within 5 days for an in-year transfer or within the first 5 days of the start of a new term to allow the new school or college to have support in place for when the child arrives."

The same paragraph continues: "The designated safeguarding lead should ensure secure transit, and confirmation of receipt should be obtained. For schools, this should be transferred separately from the main pupil file."

Annex B, on the role of the designated safeguarding lead, repeats the clock – "This should be transferred separately from the main pupil file, ensuring secure transit, and confirmation of receipt should be obtained" – and adds two expectations that are new in the 2026 edition. "Where child protection files are transferred, the exporting school or college should include a clear, structured summary identifying current safeguarding concerns, relevant context, and any ongoing support needs." And receiving schools and colleges "should ensure that safeguarding information is reviewed by an appropriately trained member of staff so that key risks and needs are clearly understood."

The same annex frames the whole exercise: "Appropriate arrangements should be in place to ensure that safeguarding information is transferred, reviewed and actioned promptly at all transition points, including in-year moves." Schools call it different things – the safeguarding file, the CP file, child protection records – but it is the same thing: the record of concerns, referrals, actions and decisions kept by the designated safeguarding lead for each child. Our guide to KCSIE records covers what it should contain before it ever moves.

When the rule applies, and the questions it leaves

The rule applies whenever a child with a child protection file leaves for another school or college. In practice that covers:

• In-year moves, where a child changes school part-way through a term. The five days run from the move.
• Phase transfers – primary to secondary, a middle school to an upper school, Year 11 to a sixth form or further education college. The file should be with the new setting within the first five days of the new term, and Annex B's reference to "all transition points" means earlier sharing is often wiser (section 03).
• Moves within a trust. A transfer between two academies in the same trust is still a transfer between two schools with two designated safeguarding leads, and the same rule applies.
• Colleges and post-16 providers. KCSIE applies to colleges, so a file goes to the college a young person moves on to, as it would to a school.

Several common questions fall outside the text, and it is better to say so than to guess:

• Do we need parental permission? No. KCSIE reminds schools that "safeguarding of children and individuals at risk" is a processing condition under data protection law – UK GDPR and the Data Protection Act 2018 – that allows special category data to be shared without consent where appropriate, and that "the data protection laws do not prevent the sharing of information for the purposes of keeping children safe" (paragraphs 146 and 147). Being open with parents is still good practice unless doing so would put the child at risk.
• University or employment? KCSIE's rule is about the new school or college. It does not require a file to be sent to a university, an employer or an apprenticeship provider that is not a college. Any sharing with them is a separate decision under data protection law, taken on the facts, with the young person's views, and recorded with its reasons.
• Home education, an unknown destination, or a move abroad. There is no receiving school, so the file cannot be transferred. The school must make a return to the local authority when a pupil's name is deleted from the admission register (paragraph 223), and an unknown destination should be treated as a possible child missing education. The file stays with the school under its retention period until a new school is known.

The clock: as soon as possible, within five days, and sometimes before

The five days are an outer limit, not a target. The wording is "as soon as possible, and within 5 days", and the stated purpose is to let the new school have support in place for when the child arrives. A file that lands on day five for a child who started on day one has met the letter and missed the point.

The child protection file runs on a different and shorter clock from the ordinary pupil record. For maintained schools, the Education (Pupil Information) (England) Regulations 2005 require the common transfer file and the educational record to go to the new school "no later than fifteen school days" after the pupil ceases to be registered (regulation 9). Schools that attach the child protection file to the pupil-record process therefore send it late as well as in the wrong envelope. KCSIE's instruction to send it separately is partly about confidentiality and partly about timing.

Sometimes the file is not enough and the information needs to arrive before the child does. In Annex B's words, "the designated safeguarding lead should also consider if it would be appropriate to share any additional information with the new school or college in advance of a child leaving", particularly where it would support an assessment of risk to others as well as the child. Its examples include "information that would allow the new school or college to continue supporting children who have had a social worker and been victims of abuse", incidents that may indicate concerns about serious violence or harmful behaviours, and children currently receiving support through the Channel programme. Paragraph 152 adds that where information indicates a risk, for example where a pupil has previously carried, threatened with, or used a knife or weapon, the receiving school should assess the risk and put a safety and support plan in place for when the child arrives.

For planned moves – Year 6 to Year 7 is the obvious one – that means the conversation can happen in the summer term, with the file following at the start of the new term. KCSIE says it "would be good practice for a conversation to take place" between the designated safeguarding leads at both settings where there are issues or concerns. That conversation is part of the transfer, and it deserves a note on the file like any other.

Sending the file: the summary, secure transit and confirmation of receipt

Four things turn a file leaving the building into a transfer that will stand up later.

1. Write the structured summary. KCSIE 2026 asks for "a clear, structured summary identifying current safeguarding concerns, relevant context, and any ongoing support needs", and for "particular care" to distinguish current concerns from historic information. Its reasoning is practical: where a file holds extensive history, "a concise summary of current risk and relevant context is likely to support more effective safeguarding than the transfer of unstructured records alone." A useful summary, which a chronology of the file makes quicker to write, names any current plan and the professionals involved, the concerns that are live now, what support has worked, what the child has said about their own situation, and who at the old school can answer questions.
2. Keep it separate. The file travels apart from the main pupil file, to a named designated safeguarding lead at the new school rather than to a general office address. Before sending, confirm who that person is.
3. Choose a secure route. KCSIE does not prescribe a method. Many schools use a system-to-system transfer in their safeguarding software where both schools use a compatible system; otherwise a secure encrypted email, or hand delivery with a signature, is common. Ordinary post and an unencrypted attachment are the routes most likely to fail the "secure transit" test. Your local safeguarding partnership may set a preferred method.
4. Obtain confirmation of receipt. A read receipt shows that an email was opened, not that the right person has the file. Ask the receiving DSL to confirm, in writing, that the file has arrived complete. If confirmation has not come back within a few days, chase it and note that you did.

Then record the transfer itself on the sending school's side: what was sent, the date, the method, the named recipient, the date receipt was confirmed and by whom, and any conversation between the two DSLs. That record is what the school produces if it is later asked whether the file reached the new school in time. It is also the first thing a successor looks for when a request for the file arrives from a third school.

Receiving it, and what the old school keeps

The receiving school has duties too. Annex B says it should have the information reviewed by "an appropriately trained member of staff", should "seek clarification where necessary" if the information is unclear or incomplete, and paragraph 150 says "receiving schools and colleges should ensure key staff such as designated safeguarding leads and special educational needs coordinators (SENCOs) or the named persons with oversight for special educational needs and disabilities (SEND) in a college, are aware as required." It is then for the DSL to decide what else is shared with which staff and when. One sentence is worth reading aloud at a staff briefing: "Safeguarding information should be used to support, not disadvantage, the child."

A receiving school that does not get a file for a new pupil it expected to have one should not wait. Ask the previous school directly, record the request, and escalate through the local authority if the file does not come.

What the sending school keeps is less settled than it sounds. KCSIE says nothing about whether the old school should retain a copy of the file, and local guidance varies, so the answer belongs in your own child protection or records policy rather than in custom. The Department for Education's record-keeping guidance for schools says child protection files "should be passed on to any new school a child attends" and sets their retention "until the child's 25th birthday", or "until the child's 75th birthday" where the file relates to child sexual abuse. Whatever is kept, keep it for a reason your policy states, under the same security as the original, and dispose of it on the same schedule.

What the sending school should always keep is the transfer record described in section 04. Without it, a school that did everything right has nothing to show for it.

The context that travels by phone

The file is the part of a transfer that is easy to audit. The part that carries the most meaning is usually the conversation around it. The old DSL rings the new one to explain what the summary could not quite say. A text follows with the social worker's number. The new DSL messages a week later, "he's said something to his form tutor, is this the same as before?", and the reply, sent from a phone in a car park, is the most useful piece of safeguarding information the new school receives all term.

KCSIE treats that conversation as good practice and asks for it where there are issues or concerns. It also asks the DSL to keep "detailed, accurate, secure written records of all concerns, discussions and decisions made including the rationale for those decisions". An exchange between two DSLs about a child who has just moved is one of those discussions. When it happens by personal text or on a consumer messaging app, the only record either school holds is whatever someone later remembered to type up, and neither school can produce the exchange itself if the transfer is ever examined.

Schools cannot lawfully reach into a colleague's personal phone, and would not want to. What they can decide is where work conversations about children happen. ComplyChat provides a channel for them that the organisation controls, with everyone added told it is on the record, and a mobile number verified by SMS is an identity on it, so a DSL at another school or a parent without a school account can be in the conversation. On paid plans, once the school's Microsoft 365 tenant is connected, the lasting record files there under the school's own retention rules. ComplyChat does not transfer child protection files, and it is not a safeguarding case-management system; the file still moves by your secure route. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive.

A question for the next leadership meeting: for the last three children who left us with a child protection file, can we show when each file arrived, who confirmed it, and what was said between the two DSLs – and where is that last part kept?

Official guidance and your next step

The primary source is Keeping children safe in education 2026: paragraphs 140 to 152 in Part two on information sharing and transfer, and the section of Annex B on information sharing and managing the child protection file. The Department for Education's record-keeping and management guidance sets retention periods, and the Education (Pupil Information) (England) Regulations 2005, regulation 9 governs the ordinary pupil record for maintained schools. Data protection law has been amended by the Data (Use and Access) Act 2025, whose data protection provisions are now all in force, so check that any ICO page you rely on reflects the amended law. Your local safeguarding partnership may publish its own transfer procedure and preferred method, and it takes precedence on the practical detail. Quotations here are from KCSIE 2026 as published for 1 September 2026.

This guide is a practical summary for schools and colleges in England, not legal advice about an individual child. Where a transfer raises a difficult judgement – a risk to others, a family in a refuge, a disputed destination – speak to your local authority and, if needed, to your data protection officer.

Then do one thing: pull the list of pupils who left with a child protection file in the last twelve months and check, for each, that the school holds a written confirmation of receipt and the date it arrived. Any gap is a transfer the school cannot currently prove it made.