Child protection policy for schools

What requires a child protection policy, and how strong the duty is

The duty behind a school's child protection policy is in law: section 175 of the Education Act 2002 requires the governing body of a maintained school to make arrangements to safeguard and promote the welfare of its pupils, and paragraph 7 of the Independent School Standards places the same duty on the proprietor of an academy or independent school. Section 175(2) of the Education Act 2002 says the governing body “shall make arrangements for ensuring that their functions relating to the conduct of the school are exercised with a view to safeguarding and promoting the welfare of children who are pupils at the school”, and section 175(4) requires them to “have regard to any guidance given from time to time (in relation to England) by the Secretary of State”. Paragraph 7 of the Independent School Standards is met if the proprietor ensures that “arrangements are made to safeguard and promote the welfare of pupils at the school” and that “such arrangements have regard to any guidance issued by the Secretary of State”.

That safeguarding guidance is Keeping children safe in education 2026 (KCSIE), which came into force on 1 September 2026 and replaced the September 2025 version. It is statutory guidance issued under section 175, the Independent School Standards Regulations 2014 and other legislation, and “Schools and colleges in England must have regard to it when carrying out their duties to safeguard and promote the welfare of children.”

The difference between must and should matters when you write the policy. KCSIE 2026 explains: “We use the term ‘must’ when the person in question is legally required to do something, and ‘should’ when the advice set out should be followed unless there is good reason not to.” The paragraphs that describe the child protection policy (121 to 129) are written as “should”. The “must” sits above them: paragraph 84 says governing bodies and proprietors “must ensure that they comply with their duties under legislation. They must have regard to this guidance, ensuring policies, procedures and training in their schools or colleges are effective and comply with the law at all times.” A school that departs from a “should” needs a reason it could explain to an inspector.

One “must” applies directly. Once the local safeguarding partners name a school as a relevant agency, paragraph 135 says schools “are under a statutory duty to co-operate with the published arrangements. They must act in accordance with the safeguarding arrangements.” That is why the policy has to follow the local arrangements rather than a national template.

Nursery and reception classes. KCSIE 2026 says “Section 3 of the Early Years Foundation Stage (EYFS) statutory framework should be read alongside KCSIE where children aged 0 to 5 attend school-based nurseries or reception classes.” Paragraph 3.5 of the EYFS statutory framework for group and school-based providers, in force from 1 September 2026, turns the policy into a “must”: “Providers must have and implement policies and procedures to keep children safe and meet EYFS requirements.” It also says “Schools are not required to have separate policies to cover EYFS requirements provided the requirements are already met through an existing policy”, so one child protection policy can serve the whole school if it covers the EYFS items listed in the next section.

Outside England. KCSIE applies to schools in England only. In Wales the equivalent is Keeping learners safe (guidance document 283/2022), which uses the term designated safeguarding person; Scotland has the National Guidance for Child Protection in Scotland 2021 – updated 2023; and Northern Ireland has its own guidance.

What a child protection policy should include: a KCSIE 2026 checklist

Paragraph 123 of KCSIE 2026 sets the core. Individual schools and colleges should have “an effective child protection policy” which:

• reflects the whole school approach to child-on-child abuse (paragraphs 192 to 193 and Part five);
• reflects the reporting systems in paragraph 121, which should be “well promoted, easily understood and easily accessible for children to confidently report, any form of abuse or neglect, knowing their concerns will be treated seriously”;
• describes procedures which are in accordance with government guidance;
• refers to the locally agreed multi-agency safeguarding arrangements put in place by the safeguarding partners (paragraphs 132 to 139);
• includes policies reflected elsewhere in Part two, such as online safety (paragraphs 164 to 169) and special educational needs and disabilities (paragraphs 249 to 251);
• is “reviewed annually (as a minimum) and updated if needed, so that it is kept up to date with safeguarding issues as they emerge and evolve, including lessons learnt”;
• is “available publicly either via the school or college website or by other means”.

Paragraph 124 adds that this “is not intended to be an exhaustive list”. Other paragraphs of KCSIE 2026 say what else the child protection policy, or the safeguarding policies and procedures around it, should hold, and a policy can be checked against them line by line:

• Child-on-child abuse (paragraph 193). Procedures to minimise the risk of it; systems for children to report abuse that are “well promoted, easily understood and easily accessible”; how allegations will be recorded, investigated and dealt with; how victims, perpetrators and any other children affected will be supported; a recognition that abuse may be taking place even when none is reported; and a zero-tolerance statement that abuse should never be passed off as “banter”, “just having a laugh”, “part of growing up” or “boys being boys”. The list of forms it can take now includes discriminatory behaviour “including racism, faith-targeted abuse, and other prejudice-based incidents”, “the threat of harm with a weapon”, harmful sexual behaviour “which may include misogyny/misandry”, and the nudes and semi-nudes item now covers making as well as sharing, “including those generated using AI”. The policy should still set out “the school or college's approach to it”.
• Online safety (paragraph 169). “Online safety and the school or college's approach to it should be reflected in the child protection policy which, amongst other things, should include appropriate filtering and monitoring on school devices and school networks.” The online safety policy guide and the guide to filtering and monitoring in schools cover the detail.
• Children with SEND (paragraph 249). The policy should reflect “the fact that additional barriers can exist when recognising abuse, neglect and exploitation in this group of children”, including children with certain medical or physical health conditions.
• Concerns about adults (paragraph 440). “It is important that policies and procedures make clear to whom allegations should be reported (as set out at paragraphs 77-79) and that this should be done without delay.” Paragraph 78 now says a concern or allegation about staff goes to the headteacher or principal, “who will consider whether an onward referral to the LADO is required” (the local authority designated officer). The allegations against staff guide and the low-level concerns guide cover those routes.
• Visitors and external speakers (paragraph 382). Safeguarding policies “should set out the arrangements for individuals coming onto their premises, which may include an assessment of the education value, the age appropriateness of what is going to be delivered and whether relevant checks will be required.”
• The designated safeguarding lead. Not a paragraph 123 item, but most policies carry it: the role and identity of the DSL and deputies, which paragraph 124 says should be given to all staff at induction alongside the policies, and the robust cover arrangements for when the DSL is unavailable, which paragraph 129 asks schools to put in place from September 2026.
• Local thresholds (paragraph 137). Governing bodies and proprietors “should understand the local criteria for action and the local protocol for assessment and ensure they are reflected in their own policies and procedures.”

The child protection policy sits beside the other safeguarding policies paragraph 123 lists: a behaviour policy with measures to prevent bullying, a staff behaviour policy or code of conduct (see the staff behaviour policy guide), and the safeguarding response to children who are absent from education. The full register of policies a school must or should hold is in statutory policies for schools.

Making a model policy your school's own

The DfE's maintained schools governance guide offers no model child protection policy: its safeguarding and child protection entry points to KCSIE itself, and it says “Governing bodies should consider asking their local authority for advice.” It lists local authority governor services, the National Governance Association, GovernorHub, the Catholic Education Service and the National Society for Education as places where advice and model policies may be available. Many schools therefore start from their local authority's or trust's model.

A model gives the structure and the child protection procedures in general terms. Before it is approved, it needs the details only the school can supply:

1. The local safeguarding arrangements. Paragraph 123 asks the policy to refer to the arrangements “put in place by the safeguarding partners”, and paragraph 137 to reflect the local criteria for action and protocol for assessment. Working Together to Safeguard Children 2026 calls them local safeguarding partners; a policy that still refers to a Local Safeguarding Children Board is out of date.
2. The people. The DSL and each deputy by name, how to reach them in and out of term, and the cover arrangement when none of them is available. Annex B says “Schools and colleges have the flexibility and discretion in how these arrangements operate”, and that it would be good practice that “whenever the DSL is unavailable, there is a clear, reliable, and known arrangement in place so that concerns can be raised”.
3. The routes out. Local contacts for children's social care, the LADO and the police, and the local name for early help: Working Together 2026 (paragraph 122) describes Family Help as “including targeted early help and statutory services under section 17 of the Children Act 1989”, and KCSIE's flowchart now says Family Help.
4. The school's own systems. Where staff record a concern (KCSIE paragraph 74 expects concerns, discussions and decisions to be recorded in writing; see the KCSIE records guide), how children report, and who provides filtering and monitoring.
5. The staff's voice. Paragraph 155: “Opportunity should therefore be provided for staff to contribute to and shape safeguarding arrangements and the child protection policy.”

Multi-academy trusts. Paragraph 123 speaks of “individual schools and colleges having” an effective child protection policy. Working Together to Safeguard Children 2026 paragraph 83 says settings, “including multi-academy trusts”, have a responsibility to play their full part in local safeguarding arrangements, including responding to safeguarding audits requested by the local authority or local safeguarding partners, “to ensure that policies are consistent with the local multi-agency safeguarding arrangements”. Ofsted's operating guide tells inspectors: “Where trust-wide policies are in place, you should focus only on their impact on the academy you are inspecting.” A trust-wide policy can work, provided each academy's local partners, DSL and routes are in it, often as a local section, and a trust spanning several local authority areas reflects each one. The audit itself is covered in the section 175 audit guide.

Approving, reviewing, publishing and sharing the policy

The governing body or proprietor is accountable for a school's child protection policy, KCSIE 2026 says it should be reviewed at least annually and be publicly available, and every member of staff should receive it at induction, with a proportionate version of the same information for temporary staff and volunteers.

• Approval. The maintained schools governance guide says “It is up to governing bodies to decide whether and how to delegate the creation, maintenance and approval of policy documents”, but “Governing bodies are accountable for these documents and the policies and procedures in them.” It recommends reviewing policies annually. In an academy or independent school the proprietor carries the paragraph 7 duty. The safeguarding link governor guide covers the board's assurance role.
• Review. Annually “as a minimum” (paragraph 123), and sooner when lessons are learnt, the local arrangements change or KCSIE is revised. Annex B says the designated safeguarding lead should ensure the policy is reviewed annually “and the procedures and implementation are updated and reviewed regularly, and work with governing bodies or proprietors regarding this”.
• Publication. Paragraph 123 says the policy should be “available publicly either via the school or college website or by other means”. For academies and independent schools, paragraph 32(1)(c) of the Independent School Standards requires “particulars of the arrangements” for safeguarding to be “published on the school's internet website or, where no such website exists, are provided to parents on request”; schools usually meet it by publishing the policy. Annex B adds that parents should know “that referrals about suspected abuse or neglect may be made and the role of the school or college in this”. The DfE's lists of what maintained schools must or should publish online and what academies and further education colleges must or should publish online have no safeguarding entry; the expectation comes from KCSIE and the standards.
• Induction. Paragraph 124: the safeguarding policies, Part one of KCSIE and “information regarding the role and identity of the designated safeguarding lead (and deputies), should be provided to all staff on induction.” Paragraph 125 says governing bodies and proprietors should take “a proportionate risk-based approach” to the information given to temporary staff, volunteers and contractors. Annex B asks the DSL to ensure each member of staff “has access to, and understands” the policy, “especially new and part-time staff”. The KCSIE Part one guide covers who reads what.
• Recruitment. Paragraph 293: schools “should also provide a copy of the school or college's child protection policy and practices and policy on employment of ex-offenders in the application pack or refer to a link on its website.”

What Ofsted looks at, and what to change from a 2025 policy

Ofsted judges safeguarding as met or not met, and its state-funded school inspection toolkit, for inspections from 7 September 2026, says that for “met”: “The school has clear and accessible policies and procedures that keep pupils safe. Leaders are receptive to challenge and are reflective about their own practices. This means that the impact of safeguarding policies, systems and processes is kept under continual review.” Inspectors evaluate whether leaders “know and are assured that policies and procedures are understood, applied and have a positive impact on pupils”.

The policy document alone does not earn that judgement. The school inspection operating guide tells inspectors “it is important to go beyond reviewing documents and ensuring that the school meets statutory requirements”, to “examine how effectively the school is implementing its safeguarding policies and processes, and how it keeps them under review”, and to “Avoid auditing paperwork.” Small fixes are allowed on the day: where inspectors find minor improvements “such as correcting small administrative errors in paperwork or updating policies”, they should give leaders “every chance” to make them before the inspection ends. The Ofsted safeguarding evidence guide covers what inspectors ask for.

If your policy was written for KCSIE 2025, check these points against the 2026 text:

1. Paragraph numbers. Every reference has moved: the policy list that was paragraph 98 is now 123, the child-on-child list at 157 is now 193, the SEND paragraphs 201 to 203 are now 249 to 251, and the online safety paragraphs from 134 are now 164 to 169. Take care with 137: in 2025 it put online safety in the child protection policy, which is now paragraph 169, and paragraph 137 is now the local criteria for action.
2. The child-on-child list. Annex C says KCSIE 2026 “Updated the list of factors that a school's child protection policy should include”. The change is in paragraph 193 – discriminatory behaviour including racism, the threat of harm with a weapon, misogyny/misandry and AI-generated nudes and semi-nudes – not in paragraph 123, whose bullets are unchanged apart from cross-references.
3. DSL cover. New paragraph 129: “schools should implement robust cover arrangements for periods when the designated safeguarding lead is unavailable due to illness, leave, or other circumstances.” The DSL handover guide covers cover and handover.
4. Local protocols and the LADO. Annex C records added expectations about local assessment protocols (paragraph 137) and a requirement to consider referral to the LADO (paragraph 78).
5. Family Help. The flowchart now says Family Help instead of Early Help.
6. Annex letters. The condensed Part one that was Annex A has gone; the role of the designated safeguarding lead is now Annex B (Annex C in 2025).
7. Regulated activity. Section 139 of the Crime and Policing Act 2026, in force on 1 September 2026, removed the “supervision exemption”. KCSIE 2026 paragraph 383 says a volunteer “teaching, training, instructing or supervising children frequently or on more than 3 days in a 30-day period or overnight is now in regulated activity”, and schools “should obtain an enhanced DBS check with children's barred list information”. The DfE has removed its “Regulated activity in relation to children: scope” document pending an update, so remove any reference to it from your policy.
8. SEND. Annex C: “Added further additional barriers that children with SEND may face.”
9. Mobile phones. KCSIE 2026 adds a mobile phone section (paragraph 170) saying schools should be mobile phone-free by default, alongside the DfE's Mobile phones in schools guidance, statutory since 29 June 2026. It concerns pupils' phones; see the mobile phone policy guide.
10. Data protection. KCSIE's data protection section was updated for the Data (Use and Access) Act 2025. Separately, section 118 of that Act abolished the office of Information Commissioner on 30 September 2026; the regulator is now the Information Commission, still known as the ICO. KCSIE 2026 predates that change and still says Information Commissioner's Office.

The EYFS framework also changed on 1 September 2026, with updates on safer sleep, screen use and banned dog breeds and “other safeguarding clarifications”, so check a nursery or reception section against paragraphs 3.4 to 3.7 as they now read.

When a concern first arrives as a message

The policy describes one route: KCSIE's flowchart says staff “follow their setting's child protection policy and speak to the designated safeguarding lead”. The first sign of a concern often arrives another way. A teaching assistant texts the DSL at nine in the evening about something a pupil said at pick-up. A parent messages the class teacher whose number they have. A lunchtime supervisor mentions a disclosure in the staff group chat before telling anyone in person.

Each of those messages is part of the record the policy depends on: what was said, by whom and when. KCSIE 2026 already reaches into how staff communicate: paragraph 123's staff behaviour policy should cover “acceptable use of technologies (including the use of mobile devices), staff/pupil relationships and communications including the use of social media”. And the new cover expectation in paragraph 129 gives as its example “a confidential shared mailbox or equivalent system”, so that concerns are picked up and acted on without delay. A message to a personal phone reaches neither the cover arrangement nor the school's record: nobody else sees it when the DSL is away, and the school cannot produce it later.

ComplyChat is designed to keep those work conversations on the school's own record. Staff, and where the school chooses, parents, talk in a channel the school holds; a mobile number verified by SMS is an identity, so teaching assistants, lunchtime staff and parents without school accounts can take part; everyone added is told it is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the school's tenant is connected, conversations are kept within its own Microsoft 365 subscription, under the retention schedules it already runs. ComplyChat is not a safeguarding case management system or the child protection file, it is not on its own the cover arrangement paragraph 129 describes, and it cannot reach messages sent in personal apps. A concern raised in a channel is still recorded in the school's safeguarding system and passed to the DSL.

A question for the next governing board or safeguarding meeting: does our child protection policy say what staff should do when a concern first reaches them by message, and where that message is kept?

Questions people ask

How do I write a safeguarding policy?

Start from the contents KCSIE 2026 sets out: paragraph 123 says each school should have an effective child protection policy that reflects the whole-school approach to child-on-child abuse, sets out reporting systems for children, follows government guidance, refers to the local multi-agency safeguarding arrangements, includes online safety and SEND, is reviewed at least annually and is publicly available. Then localise it to your safeguarding partners' criteria for action (paragraph 137), name your own DSL and deputies, and give staff a chance to shape it (paragraph 155).

What are some common safeguarding policies in schools?

KCSIE 2026 paragraph 123 lists the core set: a child protection policy; a behaviour policy with measures to prevent bullying; a staff behaviour policy (code of conduct) covering low-level concerns, allegations against staff, whistleblowing, acceptable use of technologies (including mobile devices) and staff/pupil relationships and communications, including social media; and safeguarding arrangements for children absent from education. Paragraph 126 adds safer recruitment policies and child protection files, and paragraph 124 says the list “is not intended to be an exhaustive list”. Online safety sits inside the child protection policy (paragraph 169), and the DfE's Mobile phones in schools guidance, statutory since 29 June 2026, sits alongside them.

What are the key changes in safeguarding policy for 2026?

KCSIE 2026, in force from 1 September 2026, updated the list of what a child protection policy should include – the child-on-child abuse list in paragraph 193 now names discriminatory behaviour including racism, the threat of harm with a weapon, misogyny/misandry and nudes or semi-nudes “including those generated using AI” – and added robust DSL cover arrangements (paragraph 129), a mobile phone section and Family Help terminology. It also reflects the Crime and Policing Act 2026, which removed the supervision exemption from regulated activity on 1 September 2026, so frequent or overnight volunteers in teaching, training, instructing or supervising roles now need an enhanced DBS check with barred list information. The condensed Annex A was withdrawn, so the DSL role is now Annex B. The KCSIE 2026 guide covers every other change.

What is an example of a safeguarding policy?

The DfE's maintained schools governance guide does not offer a model child protection policy: its safeguarding entry points to KCSIE, and it says governing bodies should consider asking their local authority for advice, with model policies also available from local authority governor services, the National Governance Association, GovernorHub, the Catholic Education Service and the National Society for Education. In Wales, Keeping learners safe provides a non-statutory model safeguarding policy at Annex 1. A model is finished only when it names your own safeguarding partners' arrangements, DSL and deputies, and reporting routes.

What are the 6 principles of safeguarding in schools?

The six principles – empowerment, prevention, proportionality, protection, partnership and accountability – come from paragraph 14.13 of the Care and support statutory guidance under the Care Act 2014, and “underpin all adult safeguarding work”. They are not the framework for children's safeguarding in schools in England, which is KCSIE 2026 read with Working Together to Safeguard Children 2026.

Does a school's child protection policy have to be published on its website?

KCSIE 2026 says the policy should be “available publicly either via the school or college website or by other means” (paragraph 123). For academies and independent schools the Independent School Standards go further: “particulars of the arrangements” for safeguarding must be published on the school's website, or provided to parents on request where there is no website (paragraph 32(1)(c)).

Official guidance and your next step

The national sources are Keeping children safe in education 2026 (paragraphs 59, 74, 78, 84, 121 to 129, 132 to 139, 155, 164 to 170, 192 to 193, 249 to 251, 293, 382 to 383 and 440, and Annexes B and C); section 175 of the Education Act 2002; paragraphs 7 and 32 of the Independent School Standards; paragraphs 3.4 to 3.7 of the EYFS framework for group and school-based providers; paragraphs 83 and 122 of Working Together to Safeguard Children 2026; Ofsted's school inspection toolkit and operating guide; and the maintained schools governance guide. Quotations are from those documents as published on 21 October 2026.

This guide summarises guidance that applies to schools in England and is not legal advice. Your local safeguarding partners set the arrangements your policy must follow, and your local authority or trust is usually the source of the model.

Then do one thing: open your current child protection policy, search it for “paragraph” and “Annex”, and check every reference against KCSIE 2026 – a policy that still cites the 2025 numbering has not yet been checked against the current guidance.