Early years safeguarding records

The rule: the duty to act, and the policy that must say how

Section 3 of the Early Years Foundation Stage (EYFS) statutory framework sets out the safeguarding and welfare requirements that, in England, “all settings that provide care for children aged 0-5 must meet”, and both versions in force from September 2026 – the group and school-based framework and the childminder framework – contain the duty. Paragraph 3.9 of the group framework (3.10 for childminders): “If providers have concerns about children’s safety or welfare, they must immediately notify their local authority children’s social care team, in line with local reporting procedures, and, in emergencies, the police.” Providers “must also take into account the government’s statutory guidance ‘Working Together to Safeguard Children’ and ‘Prevent duty guidance for England and Wales’”; schools must have regard to Keeping children safe in education, and “other childcare providers may also find it helpful to read this guidance”. Paragraph 3.4 makes someone responsible: “In every setting, a practitioner must be designated to take lead responsibility for safeguarding children”, liaising with children’s social care and the local safeguarding partners, and “every person looking after children must be alert to any issues of concern in the child’s life at home or elsewhere”. For a childminder working alone, that person is the childminder (childminder framework, 3.4).

The policy the records sit under is prescribed. Paragraph 3.6 (childminders 3.7): “Safeguarding policies must include: the action to be taken when there are safeguarding concerns about a child; the action to be taken in the event of an allegation being made against a member of staff; how mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting; procedures to follow to check the suitability of new recruits; [and] detail of how safeguarding training is delivered and how practitioners are supported to put this into practice.” Group providers must have these “recorded in writing” (3.5); childminders need not write them but “must be able to explain” them (childminder 3.6). All must be “in line with the guidance and procedures of the relevant Local Safeguarding Partners”, and the DSL must have, and practitioners must renew every two years, the training paragraphs 3.31 to 3.33 require.

Working Together to Safeguard Children 2026 supplies the multi-agency frame: paragraph 271 restates the EYFS duties for early years providers, and paragraph 359 says every voluntary, charity, social enterprise and private sector organisation “should have in place the arrangements described in this chapter” – among them, in paragraph 259, “a senior board level lead”, “a designated practitioner”, “clear whistleblowing procedures”, “clear escalation policies” and “arrangements which set out clearly the processes for sharing information”, and its information-sharing section (chapter 1, paragraphs 29 to 37) is the reference for what may be shared without consent when a child may be at risk of significant harm.

The records: concern, file, referral, allegation, notification

Five records, each with a home:

1. The record of concern. Every worry about a child, however small, on the setting’s form, by the person who noticed it, the same day, passed to the DSL. This is the record that makes paragraph 3.9’s “immediately” provable.
2. The child’s safeguarding file. A separate, confidential file for each child about whom there has been a concern, holding the concern records, the DSL’s decisions and reasons, contact with the family and other agencies, referrals and outcomes, and a chronology. The NSPCC’s guidance is that information about concerns and referrals “should be kept in a separate child protection file for each child”, started “as soon as you become aware of any concerns”.
3. The referral record. What was sent to children’s social care and when, under the local thresholds, the reference given, what came back, and – where the DSL decided not to refer – the reason, because a decision not to act is a decision the record has to show.
4. The allegations record. A concern that a member of staff, an assistant, a volunteer or anyone in a childminder’s household may have harmed a child or may pose a risk: what was alleged, the contact with the local authority designated officer, the police where a crime may have been committed, the notification to Ofsted, the outcome, and any referral to the DBS. Kept on the adult’s file, apart from the children’s.
5. The notification record. Under paragraph 3.10 (childminders 3.11), registered providers “must inform Ofsted, or the CMA … of any allegations of harm or abuse by anyone living, working, or looking after children at the premises”, on the premises or elsewhere, together with “the action they have taken in response”, “as soon as is reasonably practicable, but in any event within 14 days of the allegations being made”; failing to “without a reasonable excuse … commits an offence”. Paragraph 3.79 does the same for serious accidents, illness, injury or death, and paragraph 3.105 for “any significant event which is likely to affect the suitability” of the provider or anyone in regular contact with the children. Each notification is recorded with its date and reference.

The concerns these records hold are the ones Working Together defines – physical abuse, emotional abuse, sexual abuse and neglect, and in the early years most often neglect and the signs of it: hunger, clothing, hygiene, missed appointments, a child’s communication and physical development falling behind. A record that names what was seen rather than which category it might fall in is the one that lets children’s social care decide.

Around them: the absence record paragraph 3.11 assumes (“providers must consider patterns and trends in a child’s absences … Any concerns must be referred to local children’s social care services and/or a police welfare check requested”), the training record for the DSL and staff, the record of the setting’s Prevent duty considerations, and, in a group setting, the records the mobile phone and camera policy generates about images.

What a record of concern contains

There is no statutory form; the local safeguarding partnership usually publishes one, and the NSPCC’s list is the sector standard. A record of concern that will stand up has:

• The child’s name, date of birth and room or group; the date and time of what was observed or said; the date and time the record was written.
• What was observed, said or disclosed, in the child’s own words where there are any, and where on a body map any mark was seen, with size and colour rather than a diagnosis (“red mark 3 cm on left upper arm” rather than “grab mark”).
• The context: what the child was doing, who was present, what the parent said at drop-off or pick-up.
• Any explanation given by the child or the parent, recorded as given.
• The name and role of the person recording it, signed and dated.
• What the DSL did: the discussion with the practitioner, the decision (monitor, speak to the parent, seek advice, refer), the reason for it, who was contacted and what they advised, and the outcome.
• The date the record was added to the child’s file and the chronology.

Two rules from the NSPCC’s guidance apply to every entry: “Make sure the report is as factual as possible and avoid opinions. Any interpretation or inference drawn from what was observed, said or alleged should be clearly reported as such”, and “the record should always be signed and dated by the person making the report”. And one from the DfE’s safeguarding guidance for out-of-school settings, which is written for clubs, activities and tuition rather than registered early years providers but makes the point plainly: where a child discloses, “it is important not to investigate the disclosure yourself as this may jeopardise a police or social care investigation”. The practitioner listens, does not ask leading questions, does not promise secrecy, writes it down at once and tells the DSL.

The chronology is the record that shows a pattern: each significant event in date order with the action taken, so that three small concerns over a term are visible as one picture. The guide on safeguarding chronologies sets out how one is kept; in a nursery it is the front sheet of the child’s file and the document that travels with the child to school.

Sharing, transfer, access and the parents

Paragraph 3.95 of the group framework requires appropriate information sharing and a regular two-way flow with parents and other settings. Consent is not normally the appropriate lawful basis for sharing information to safeguard a child. Identify the applicable lawful basis, share necessary and proportionate information promptly with the right agency, and record what was shared and why. Be open with the child and family where safe, but do not let seeking consent delay protection. See the DfE information-sharing guidance, which from September 2026 is statutory guidance on the information sharing duty in section 16LA of the Children Act 2004, in force from 30 September 2026; the page lists early years among the sectors it applies to.

Parents have a right of access to “all records about their child, provided that no relevant exemptions apply to their disclosure under the Data Protection Act” (3.97), and the framework’s footnote is precise about the exemption that matters here: “a relevant professional will need to give careful consideration as to whether the disclosure of certain information about a child could cause harm either to the child or any other individual”. A safeguarding file is not withheld from a parent as a matter of course; each record in it is considered, and the reasoning for withholding any of it is written down.

How the setting responds and how it shares information should both be written into the safeguarding policy, so that a practitioner knows the DSL will share with the health visitor, the school or social care where a child’s welfare requires it, and a parent has been told, in the privacy notice, that the setting may do so. When the child leaves – for school, or another setting – the safeguarding file goes with them, separately from the learning journey and the general records, by a secure route, with a receipt, and with a short summary of current concerns at the front so the receiving DSL does not have to reconstruct a year from the raw records. Where a child attends two settings, the two DSLs share what each needs to know, and both record that they did.

What Ofsted asks to see, and how long the records are kept

Ofsted’s inspection information for use from September 2026 lists, among the documents inspectors “may need to see”, “referrals made to the local authority designated officer for safeguarding, and their resolution” and “details of all children who are an open case to social care/children’s services and for whom there is a multi-agency plan”, alongside the EYFS policies, accident records and complaints. Settings must be able to provide them “either online or in printed form, during inspection”, and the inspector “will cover the matters relating to them during discussions” – the DSL will be asked to talk through a concern, what was done and why, and the record is what makes that conversation an account rather than a memory. Ofsted’s significant events guidance adds that involvement with safeguarding partners “about incidents or concerns that might affect someone’s suitability” is itself a notification.

Retention is the provider’s decision under paragraph 3.98, and safeguarding records need their own schedule informed by the relevant law and specialist guidance. The NSPCC’s retention and storage guidelines (September 2026) no longer set general periods; they point to the sectors with their own rules, and the education rules are the usual benchmark: in schools in England and Wales the child protection file “should be kept until the child is 25”, and records of concerns about an adult are kept “at least until they reach normal pension age or for 10 years, whichever is longer”. Where records “could be needed as part of an official inquiry”, the “retention requirements will be set out in directions issued by the inquiry and must be followed”. Apply the period justified for each record type, with separate handling for safeguarding files and any legal hold; do not assume every ordinary record has the same shorter period.

These records contain personal data about children and families, and may include special category data and criminal-offence information. UK GDPR requires an Article 6 lawful basis and, for special category data, an Article 9 condition together with any applicable Data Protection Act 2018 requirements, a privacy notice that tells parents concerns are recorded and may be shared, security proportionate to the sensitivity, access limited to the DSL and those who need it, and the retention schedule actually applied.

The concern that is first raised in a message

Paragraph 3.9 says “immediately”; look at how a concern in a nursery actually travels. The practitioner who saw the mark at nappy change tells the room leader; the room leader, mid-room, messages the manager on the staff WhatsApp: “can you come to toddlers when you get a sec, need to show you something on J”. The manager is off site, so the deputy is asked by message, and the deputy’s response about contacting children’s social care is part of the record of action taken. Follow the setting’s procedure immediately; do not photograph injuries on a personal device or delay a referral while completing paperwork. The practitioner who is uneasy about a colleague messages a friend on the staff after the shift. A parent texts the key person’s personal number about another parent. A childminder messages a fellow childminder for advice about a child before ringing anyone. The record of concern, when it is written, begins at the form; the concern began an hour earlier, in words the setting cannot now produce.

The framework requires records that are accurate, kept securely and available to Ofsted; it requires an allegation to be notified within fourteen days with the action taken; and the local authority and any later review will ask when the concern was first raised, what exactly was seen, and what the DSL decided and when. The answers are on personal phones, in an app the setting does not run, in a group where everyone saw the child’s name, and the setting cannot search them without the questions the ICO’s guidance on personal devices raises. The pattern the chronology exists to show – two practitioners each with a doubt about the same child, shared with each other and never with the DSL – is invisible to it.

Use a restricted reporting route, with access limited to the people who need the information. A recorded message is not proof that someone has read or acted on a concern: follow the safeguarding procedure, contact the responsible person directly when action is urgent, and use the local authority or emergency route when required. Add the relevant information and decisions promptly to the formal safeguarding record.

The remedy is not to stop practitioners telling each other what they saw; it is the culture paragraph 3.4 asks for. It is to give those first tellings a channel the setting owns, available through devices and procedures permitted by the setting’s mobile-phone policy, without interrupting supervision, where the DSL is in the conversation from the first message, where everyone in it has been told it is on the record, and where the time, the words and the DSL’s reply are preserved to support the formal record of concern. The question for the manager, the owner or the childminder is whether the setting could produce, today, the message in which its last concern was first raised.

Questions people ask

What should be included in a safeguarding record?

A safeguarding record should include “a clear and comprehensive summary of the concern”, “details of how the concern was followed up and resolved” and “a note of any action taken, decisions reached and the outcome” (paragraph 74 of Keeping children safe in education 2026, which the EYFS says other childcare providers “may also find it helpful to read”). The NSPCC’s child protection records retention and storage guidelines add the date and time of the incident and of the report, the names of everyone involved, and the reasons for any decision not to refer the concern to a statutory agency.

How should safeguarding concerns be recorded?

Safeguarding concerns should be recorded in writing and factually: Keeping children safe in education 2026, which schools must have regard to, says “all concerns, discussions and decisions made, and the reasons for those decisions, should be recorded in writing”, and that it is good practice to keep them in a separate child protection file for each child. The NSPCC’s guidelines are to make the report “as factual as possible”, to report any interpretation clearly as such, and to have it “signed and dated by the person making the report”.

What are the EYFS safeguarding requirements?

The EYFS safeguarding requirements are in section 3 of the statutory framework. In the group and school-based version they include a designated safeguarding lead (3.4), safeguarding policies and procedures, which should be recorded in writing (3.5 and 3.6), whistleblowing procedures (3.7), notifying children’s social care immediately of concerns about a child’s safety or welfare (3.9), telling Ofsted of any allegation of harm or abuse within 14 days (3.10), safer recruitment checks on the suitability of staff (3.13 to 3.18) and safeguarding training renewed every two years (3.33).

What does the EYFS say about record keeping?

The EYFS says providers “must maintain records, obtain and share relevant and accurate information” with parents, other professionals, the police, social services and Ofsted as appropriate (paragraph 3.95 of the group and school-based framework). Records “must be easily accessible and available”, confidential records about staff and children “must be held securely”, parents must be given access to their child’s records unless a data protection exemption applies, and records about individual children “must be retained for a reasonable period of time” after the child leaves.

What is a safeguarding concern in a nursery?

A safeguarding concern in a nursery is any worry about a child’s safety or welfare, and paragraph 3.9 of the EYFS framework says providers with such concerns “must immediately notify their local authority children’s social care team, in line with local reporting procedures, and, in emergencies, the police”. A concern can also be about an adult: an allegation of harm or abuse by anyone living, working or looking after children at the premises must be notified to Ofsted, with the action taken, as soon as reasonably practicable and within 14 days (3.10).

What are the key changes to EYFS safeguarding in 2026?

The EYFS frameworks that took effect on 1 September 2026 (paragraphs given as group and school-based, then childminder) require allegations of “harm” rather than “serious harm” to be reported to Ofsted or the childminder agency (3.10; 3.11). Supervised volunteers now need enhanced criminal records and barred list checks unless they only help occasionally; no one needing a check may start before it arrives; and staff must be told to disclose arrests and charges as well as convictions (3.15 and 3.17; 3.17 and 3.18). They also write the safer sleep requirements into the main text (3.86 in both), ban childcare where a banned dog breed is kept or present (3.82; 3.81), require providers to have regard to screen use guidance (3.94; 3.93) and, in the group framework, require changes to people aged 16 or over living or working on domestic premises to be notified (3.105), as the Department for Education’s summary of changes to the EYFS framework sets out. The guide to EYFS safeguarding and welfare requirements maps each change.

Official guidance and your next step

The primary sources are the two EYFS statutory frameworks in force from September 2026 (section 3: paragraphs 3.4 to 3.11, 3.31 to 3.33 and 3.95 to 3.107 of the group and school-based framework, and their equivalents for childminders), Working Together to Safeguard Children 2026 and the DfE’s Information Sharing Duty statutory guidance (September 2026), which replaces the non-statutory advice Working Together points to, Ofsted’s early years inspection information and significant events guidance, and the NSPCC’s child protection records retention and storage guidelines. The local safeguarding partnership publishes the thresholds, the referral route, the concern form and the LADO’s contact details; the Early Years Alliance and the NSPCC publish template forms and body maps.

This guide is a summary of published guidance for England, not a substitute for it and not legal advice. School nursery classes follow Keeping children safe in education as well; settings in Wales, Scotland and Northern Ireland have their own frameworks.

Then do one thing: take the last three records of concern and, for each, write in the margin how the DSL first heard about it and at what time. If the honest answer is a message on somebody’s phone, that margin is where the record actually began.