Early years safeguarding records

The rule: the duty to act, and the policy that must say how

Section 3 of the EYFS statutory framework (both the group and school-based version and the childminder version, in force from September 2026) contains the duty. Paragraph 3.9 of the group framework (3.10 for childminders): “If providers have concerns about children’s safety or welfare, they must immediately notify their local authority children’s social care team, in line with local reporting procedures, and, in emergencies, the police.” Providers “must also take into account the government’s statutory guidance ‘Working Together to Safeguard Children’ and ‘Prevent duty guidance’”; schools must have regard to Keeping children safe in education, and “other childcare providers may also find it helpful to read this guidance”. Paragraph 3.4 makes someone responsible: “In every setting, a practitioner must be designated to take lead responsibility for safeguarding children”, liaising with children’s social care and the local safeguarding partners, and “every person looking after children must be alert to any issues of concern in the child’s life at home or elsewhere”. For a childminder working alone, that person is the childminder (childminder framework, 3.4).

The policy the records sit under is prescribed. Paragraph 3.6 (childminders 3.7): “Safeguarding policies must include: the action to be taken when there are safeguarding concerns about a child; the action to be taken in the event of an allegation being made against a member of staff; how mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting; procedures to follow to check the suitability of new recruits; [and] detail of how safeguarding training is delivered and how practitioners are supported to put this into practice.” Group providers must have these “recorded in writing” (3.5); childminders need not write them but “must be able to explain” them (childminder 3.6). All must be “in line with the guidance and procedures of the relevant Local Safeguarding Partners”, and the DSL must have, and practitioners must renew every two years, the training paragraphs 3.31 to 3.33 require.

Working Together to Safeguard Children 2026 supplies the multi-agency frame: early years and childcare organisations are among those that should have “a senior board level lead”, “a designated practitioner”, “clear whistleblowing procedures”, “clear escalation policies” and “arrangements which set out clearly the processes for sharing information” (paragraph 259), and its information-sharing chapter is the reference for what may be shared without consent when a child may be at risk of significant harm.

The records: concern, file, referral, allegation, notification

Five records, each with a home:

1. The record of concern. Every worry about a child, however small, on the setting’s form, by the person who noticed it, the same day, passed to the DSL. This is the record that makes paragraph 3.9’s “immediately” provable.
2. The child’s safeguarding file. A separate, confidential file for each child about whom there has been a concern, holding the concern records, the DSL’s decisions and reasons, contact with the family and other agencies, referrals and outcomes, and a chronology. The NSPCC’s guidance is to keep concerns “in a separate child protection file for each child, rather than in one ‘concern log’”, started “as soon as you become aware of any concerns”.
3. The referral record. What was sent to children’s social care and when, under the local thresholds, the reference given, what came back, and – where the DSL decided not to refer – the reason, because a decision not to act is a decision the record has to show.
4. The allegations record. A concern that a member of staff, an assistant, a volunteer or anyone in a childminder’s household may have harmed a child or may pose a risk: what was alleged, the contact with the local authority designated officer, the police where a crime may have been committed, the notification to Ofsted, the outcome, and any referral to the DBS. Kept on the adult’s file, apart from the children’s.
5. The notification record. Under paragraph 3.10 (childminders 3.11), registered providers “must inform Ofsted, or the CMA … of any allegations of harm or abuse by anyone living, working, or looking after children at the premises”, on the premises or elsewhere, together with “the action they have taken in response”, “as soon as is reasonably practicable, but in any event within 14 days of the allegations being made”; failing to “without a reasonable excuse … commits an offence”. Paragraph 3.79 does the same for serious accidents, illness, injury or death, and paragraph 3.105 for “any significant event which is likely to affect the suitability” of the provider or anyone in regular contact with the children. Each notification is recorded with its date and reference.

The concerns these records hold are the ones Working Together defines – physical abuse, emotional abuse, sexual abuse and neglect, and in the early years most often neglect and the signs of it: hunger, clothing, hygiene, missed appointments, a child’s communication and physical development falling behind. A record that names what was seen rather than which category it might fall in is the one that lets children’s social care decide.

Around them: the absence record paragraph 3.11 assumes (“providers must consider patterns and trends in a child’s absences … Any concerns must be referred to local children’s social care services and/or a police welfare check requested”), the training record for the DSL and staff, the record of the setting’s Prevent duty considerations, and, in a group setting, the records the mobile phone and camera policy generates about images.

What a record of concern contains

There is no statutory form; the local safeguarding partnership usually publishes one, and the NSPCC’s list is the sector standard. A record of concern that will stand up has:

• The child’s name, date of birth and room or group; the date and time of what was observed or said; the date and time the record was written.
• What was observed, said or disclosed, in the child’s own words where there are any, and where on a body map any mark was seen, with size and colour rather than a diagnosis (“red mark 3 cm on left upper arm” rather than “grab mark”).
• The context: what the child was doing, who was present, what the parent said at drop-off or pick-up.
• Any explanation given by the child or the parent, recorded as given.
• The name and role of the person recording it, signed and dated.
• What the DSL did: the discussion with the practitioner, the decision (monitor, speak to the parent, seek advice, refer), the reason for it, who was contacted and what they advised, and the outcome.
• The date the record was added to the child’s file and the chronology.

Two rules from the NSPCC’s guidance apply to every entry: “Make sure the report is factual. Any interpretation or inference drawn from what was observed, said or alleged should be clearly reported as such. The record should always be signed and dated by the person making the report.” And one from the DfE’s guidance for out-of-school settings, which early years settings follow in practice: where a child discloses, “it is important not to investigate the disclosure yourself as this may jeopardise a police or social care investigation”. The practitioner listens, does not ask leading questions, does not promise secrecy, writes it down at once and tells the DSL.

The chronology is the record that shows a pattern: each significant event in date order with the action taken, so that three small concerns over a term are visible as one picture. The guide on safeguarding chronologies sets out how one is kept; in a nursery it is the front sheet of the child’s file and the document that travels with the child to school.

Sharing, transfer, access and the parents

Paragraph 3.95 of the group framework requires appropriate information sharing and a regular two-way flow with parents and other settings. Consent is not normally the appropriate lawful basis for sharing information to safeguard a child. Identify the applicable lawful basis, share necessary and proportionate information promptly with the right agency, and record what was shared and why. Be open with the child and family where safe, but do not let seeking consent delay protection. See the DfE information-sharing advice.

Parents have a right of access to “all records about their child, provided that no relevant exemptions apply to their disclosure under the Data Protection Act” (3.97), and the framework’s footnote is precise about the exemption that matters here: “a relevant professional will need to give careful consideration as to whether the disclosure of certain information about a child could cause harm either to the child or any other individual”. A safeguarding file is not withheld from a parent as a matter of course; each record in it is considered, and the reasoning for withholding any of it is written down.

How the setting responds and how it shares information should both be written into the safeguarding policy, so that a practitioner knows the DSL will share with the health visitor, the school or social care where a child’s welfare requires it, and a parent has been told, in the privacy notice, that the setting may do so. When the child leaves – for school, or another setting – the safeguarding file goes with them, separately from the learning journey and the general records, by a secure route, with a receipt, and with a short summary of current concerns at the front so the receiving DSL does not have to reconstruct a year from the raw records. Where a child attends two settings, the two DSLs share what each needs to know, and both record that they did.

What Ofsted asks to see, and how long the records are kept

Ofsted’s inspection information for use from September 2026 lists, among the documents inspectors “may need to see”, “referrals made to the local authority designated officer for safeguarding, and their resolution” and “details of all children who are an open case to social care/children’s services and for whom there is a multi-agency plan”, alongside the EYFS policies, accident records and complaints. Settings must be able to provide them “either online or in printed form, during inspection”, and the inspector “will cover the matters relating to them during discussions” – the DSL will be asked to talk through a concern, what was done and why, and the record is what makes that conversation an account rather than a memory. Ofsted’s significant events guidance adds that involvement with safeguarding partners “about incidents or concerns that might affect someone’s suitability” is itself a notification.

Retention is the provider’s decision under paragraph 3.98, and safeguarding records need their own schedule informed by the relevant law and specialist guidance. The NSPCC’s retention and storage guidelines say the child protection file “should be kept until the child is 25”, that records of concerns about an adult’s behaviour around children are kept “at least until they reach their normal retirement age or for 10 years – whichever is longer”, and that “organisations should keep any records that could be needed by an official inquiry”, which “will issue directions for records to be retained and these must be followed”. Apply the period justified for each record type, with separate handling for safeguarding files and any legal hold; do not assume every ordinary record has the same shorter period.

These records contain personal data about children and families, and may include special category data and criminal-offence information. UK GDPR requires an Article 6 lawful basis and, for special category data, an Article 9 condition together with any applicable Data Protection Act 2018 requirements, a privacy notice that tells parents concerns are recorded and may be shared, security proportionate to the sensitivity, access limited to the DSL and those who need it, and the retention schedule actually applied.

The concern that is first raised in a message

Paragraph 3.9 says “immediately”; look at how a concern in a nursery actually travels. The practitioner who saw the mark at nappy change tells the room leader; the room leader, mid-room, messages the manager on the staff WhatsApp: “can you come to toddlers when you get a sec, need to show you something on J”. The manager is off site, so the deputy is asked by message, and the deputy’s response about contacting children’s social care is part of the record of action taken. Follow the setting’s procedure immediately; do not photograph injuries on a personal device or delay a referral while completing paperwork. The practitioner who is uneasy about a colleague messages a friend on the staff after the shift. A parent texts the key person’s personal number about another parent. A childminder messages a fellow childminder for advice about a child before ringing anyone. The record of concern, when it is written, begins at the form; the concern began an hour earlier, in words the setting cannot now produce.

The framework requires records that are accurate, kept securely and available to Ofsted; it requires an allegation to be notified within fourteen days with the action taken; and the local authority and any later review will ask when the concern was first raised, what exactly was seen, and what the DSL decided and when. The answers are on personal phones, in an app the setting does not run, in a group where everyone saw the child’s name, and the setting cannot search them without the questions the ICO’s guidance on personal devices raises. The pattern the chronology exists to show – two practitioners each with a doubt about the same child, shared with each other and never with the DSL – is invisible to it.

Use a restricted reporting route, with access limited to the people who need the information. A recorded message is not proof that someone has read or acted on a concern: follow the safeguarding procedure, contact the responsible person directly when action is urgent, and use the local authority or emergency route when required. Add the relevant information and decisions promptly to the formal safeguarding record.

The remedy is not to stop practitioners telling each other what they saw; it is the culture paragraph 3.4 asks for. It is to give those first tellings a channel the setting owns, available through devices and procedures permitted by the setting’s mobile-phone policy, without interrupting supervision, where the DSL is in the conversation from the first message, where everyone in it has been told it is on the record, and where the time, the words and the DSL’s reply are preserved to support the formal record of concern. The question for the manager, the owner or the childminder is whether the setting could produce, today, the message in which its last concern was first raised.

Official guidance and your next step

The primary sources are the two EYFS statutory frameworks in force from September 2026 (section 3: paragraphs 3.4 to 3.11, 3.31 to 3.33 and 3.95 to 3.107 of the group and school-based framework, and their equivalents for childminders), Working Together to Safeguard Children 2026 and the information-sharing advice it points to, Ofsted’s early years inspection information and significant events guidance, and the NSPCC’s child protection records retention and storage guidelines. The local safeguarding partnership publishes the thresholds, the referral route, the concern form and the LADO’s contact details; the Early Years Alliance and the NSPCC publish template forms and body maps.

This guide is a summary of published guidance for England, not a substitute for it and not legal advice. School nursery classes follow Keeping children safe in education as well; settings in Wales, Scotland and Northern Ireland have their own frameworks.

Then do one thing: take the last three records of concern and, for each, write in the margin how the DSL first heard about it and at what time. If the honest answer is a message on somebody’s phone, that margin is where the record actually began.