ComplyChat guides · 45 guides
Guides for nurseries and childminders
An early years setting carries the EYFS statutory framework, Ofsted’s registration and notification rules, safeguarding duties and UK GDPR, usually without a compliance team. These guides set out what each one asks of a nursery or a childminder, quote the official wording, and name the record you should be able to produce. The guides on staff messaging, personal phones and data protection apply to every employer, so they are here too.
Where to start
- Nursery record keeping requirements under the EYFSThe main nursery records required by the EYFS from September 2026, with Ofsted notifications, inspection access, confidentiality and retention.
- Childminder record keeping: what the EYFS requires you to keepThe EYFS records childminders need, which policies need not be written, Ofsted notifications, inspection access, security and retention.
- Notifying Ofsted of changes: what early years providers must reportThe changes and events nurseries and childminders in England must notify to Ofsted, the 14-day deadline, how to notify, and the record to keep.
- Early years safeguarding records: what the EYFS requiresConcern records, safeguarding files, referrals and notifications for nurseries and childminders, with information sharing and retention guidance.
- GDPR for nurseries and childminders: what the law asks of youHow UK GDPR applies to nurseries and childminders in England: the ICO fee, privacy notices, lawful basis, photos, parents' requests and data breaches.
- Ofsted DBS checks: childminders, household members and nursery staffWho needs an Ofsted DBS check, which check, how childminders and household members apply, the update service, and what nurseries must check themselves.
Governance and the board
- Guide · Governance
Minute taking: what to record and what to leave out
What belongs in meeting minutes and what does not, who should take them, a reusable structure, and why the minute book no longer sees every decision.
- Guide · Governance
Grievance procedure: the Acas Code steps and what to record
A grievance procedure under the Acas Code: what a grievance is, the steps, the meeting, accompaniment, the outcome and appeal, what to record, and tribunal time limits.
Work conversations on personal phones
- Guide · Data protection
Is WhatsApp GDPR compliant for work?
The three different things called WhatsApp, the five duties that are hard to meet whichever you mean, whether an employer can require its use, and what metadata Meta receives.
- Guide · Data protection
Subject access requests and WhatsApp messages
What an employer must disclose, what may be withheld or redacted, how tribunals treat them, and what to do when the messages cannot be produced at all.
- Guide · Work messaging
Work messages on personal phones: what the organisation is responsible for, what it can and cannot see, and what the policy has to say
Work messages on staff’s own phones in a school, charity or care service: why the organisation is the controller of what its staff hold there, what the ICO says about personal devices and subject access requests, the limits on looking at a worker’s own phone, what the Cabinet Office’s rules for WhatsApp and private email say a workplace policy should copy, and the record that never reaches the organisation.
- Guide · Work messaging
WhatsApp messages as evidence: tribunals, inspections and regulators, and the organisation that cannot produce them
WhatsApp and text messages as evidence for an organisation in the UK: how a message becomes a document in an employment tribunal, an inspection or a regulator’s inquiry, what the Civil Evidence Act says about copies and business records, the duty to disclose messages that harm your case, screenshots against exports and what authenticity turns on, subject access requests, and the position of the organisation that cannot produce the messages at all.
- Guide · Work messaging
Personal mobile phone policy for staff: what it must cover in a school, a charity or a care service
A personal mobile phone policy for staff in a school, charity or care service: the rules that make one necessary (KCSIE’s staff behaviour policy, the ICO’s guidance on personal devices and on checking workers’ communications, CQC’s records duty), the difference between a pupils’ phone policy and a staff one, the eight things the policy has to cover, what it cannot lawfully do, and the record the policy has to create.
- Guide · Work messaging
Staff messaging policy: what it must say about channels, records, hours and personal phones
A staff messaging policy for a school, charity or care service: the channels that are permitted for which work and the ones that are not, the record every message about a person or a decision has to reach, the Cabinet Office’s rules for WhatsApp, private email and SMS as the published model, hours and expectations, what the organisation may and may not look at under the ICO’s guidance, and the paragraph most policies leave out.
- Guide · Data protection
WhatsApp retention policy: what you can keep and what to write
A retention policy for work messages on WhatsApp: what the app keeps, disappearing messages, backups, leavers' phones, holds, and the rows a UK retention schedule needs.
- Guide · Work messaging
WhatsApp messages in a disciplinary hearing: using them fairly
Using WhatsApp messages in an internal disciplinary under the Acas Code: how they reach the employer, Article 8 and privacy, authenticity, and the employee's own copies.
- Guide · Work messaging
Teams chat retention policy: what Microsoft 365 keeps and deletes
How Microsoft Purview retention policies work for Teams chats and channel messages, what they include and exclude, how deletion really runs, and who is outside them.
- Guide · Governance
Acceptable use policy for staff: schools, charities and care
A staff acceptable use policy for IT, devices and messaging in schools, charities and care: what KCSIE 2026 requires, what to cover, personal devices, and enforcement.
- Guide · Work messaging
WhatsApp group admin responsibilities when the group is for work
What a WhatsApp group admin can and cannot do, and what the admin of a staff, volunteer or parent group answers for: data protection, safeguarding, records.
- Guide · Work messaging
Right to disconnect policy: the UK legal position and what to write
The UK has no statutory right to disconnect. What the law does require for messages after work hours, and how to write a voluntary out-of-hours policy.
- Guide · Data protection
WhatsApp Advanced Chat Privacy: what it blocks in a work group
What WhatsApp’s Advanced Chat Privacy and its replacement, Restricted chat, block and allow, and what that means for a work group’s requests and evidence.
- Guide · Data protection
Bring your own device policy: security and UK GDPR for work data
A BYOD policy for staff using their own phones, tablets and laptops for work data: the ICO’s view, NCSC controls, Cyber Essentials scope, privacy and leavers.
Safeguarding and raising concerns
- Guide · Safeguarding
Safeguarding training records: what schools, charities and care providers must keep, and what an inspector asks to see
Safeguarding training records for schools, charities and adult social care in England: who has to be trained and how often under KCSIE 2026, the Charity Commission’s guidance and CQC Regulation 18, what a training record has to show, what Ofsted and CQC actually ask for, how long to keep it, and the update that is delivered as a message and never reaches the file.
- Guide · Governance
Whistleblowing policy: what it must include
Which disclosures the Public Interest Disclosure Act protects, who is covered, what detriment means, and the confidentiality you cannot honestly promise.
- Guide · Safeguarding
Making a MASH referral: what to record before, during and after
A concern followed from the first note to the outcome: thresholds, consent and the new information sharing duty, the one-working-day and 45-day timescales, and the record at each stage.
- Guide · Safeguarding
Safeguarding concern form: what to record and where it goes next
What a safeguarding concern form should record for a child or an adult at risk, how to write it, what the council's adult form asks, and where it goes next.
- Guide · Safeguarding
Information sharing between agencies: the duty, tests and record
How safeguarding information is shared between agencies under the section 16LA duty from 30 September 2026 and Working Together 2026, and what to record.
- Guide · Safeguarding
Prevent duty training records: who to train and what to keep
The Prevent duty for schools, colleges and childcare in England and Wales: who needs Prevent training, how often, and the training and compliance records to keep.
- Guide · Safeguarding records
Safeguarding chronology
What belongs in a safeguarding chronology, how to record significant events, who maintains it and how it supports assessment and file transfer.
- Guide · Safeguarding records
Contemporaneous notes: what they are and how to write one
What a contemporaneous note is, why courts, tribunals and regulators give it weight, and how to write one: date, time, exact words, facts, no later edits.
- Guide · Safeguarding
Types of abuse in safeguarding: the statutory definitions
The types of abuse as England's statutory guidance defines them for children and adults, the difference between signs and proof, what to record and who to tell.
Records and data protection
- Guide · Data protection
Data retention policy: UK requirements and how to write one
What UK GDPR storage limitation actually requires, how to build a retention schedule, where the seven-year rule really comes from, and how deletion is proved.
- Guide · Data protection
DBS record keeping: what to keep, for how long, and what never to copy
What the DBS code of practice lets you record, the single central record's checklist, the six-month rule for copies and the places a certificate must never appear.
- Guide · Data protection
Subject access request policy: how to respond, and the exemptions
What a subject access request policy should say, how to respond on time, the exemptions, and the 2025 Act changes to searches and the clock.
- Guide · Data protection
Right to erasure under UK GDPR: when it applies, how to respond
The right to erasure under UK GDPR Article 17: the grounds, the exceptions for legal obligations, safeguarding and care records, and the one-month clock.
- Guide · Data protection
How long to keep employee records in the UK: statutory periods
How long UK employers must keep employee records: PAYE, minimum wage, holiday, right to work, pensions and accidents, with safeguarding periods for schools and care.
- Guide · Work messaging
Message archiving for compliance in schools, charities and care
Why organisations archive work messages – access requests, FOI, safeguarding, disputes – capture after the fact or at source, and Microsoft 365 retention.
- Guide · Data protection
Data breach log: what to record for every breach, reported or not
The breach log UK GDPR Article 33(5) requires for every personal data breach: the ICO’s template fields, near misses, charity and care reporting, and retention.
- Guide · Data protection
Record of processing activities: what Article 30 requires you to keep
What a record of processing activities must contain under Article 30 UK GDPR, who must keep one, the fewer-than-250-employees exception and how to build it.
- Guide · Data protection
Data protection training for staff: what to cover and what to record
Data protection training for staff in schools, charities and care: what UK GDPR and the ICO expect, who needs it, how often, and the training record to keep.
Choosing a tool
- Guide · Choosing
Messaging app with an audit trail: what to look for
What an audit trail means in messaging, why end-to-end encrypted consumer apps cannot provide one, the questions to ask a supplier, and where the record should live.
- Guide · Choosing
Choosing a work messaging app
What Slack, Teams and Google Chat actually differ on, what happens when the people you need have no work account, and what a free plan does to your message history.
- Guide · Choosing
A GDPR compliant messaging app: what "compliant" has to mean for a UK organisation
No app is compliant on its own: the Article 28 contract, encryption and what it does not do, restricted transfers, the Article 30 record, subject access, retention and the 72 hour breach clock, and the questions to put to any vendor.
- Guide · Work messaging
Encrypted messaging for business in the UK: what it leaves open
What end-to-end encryption protects, what it leaves open, what the NCSC asks of a work messaging app, and the trade-off with keeping and producing a record.
Early years
- Guide · Early years
Nursery record keeping requirements
The main nursery records required by the EYFS from September 2026, with Ofsted notifications, inspection access, confidentiality and retention.
- Guide · Early years
Childminder record keeping
The EYFS records childminders need, which policies need not be written, Ofsted notifications, inspection access, security and retention.
- Guide · Early years
Early years safeguarding records
Concern records, safeguarding files, referrals and notifications for nurseries and childminders, with information sharing and retention guidance.
- Guide · Early years
Ofsted DBS checks: childminders, household members and nursery staff
Who needs an Ofsted DBS check, which check, how childminders and household members apply, the update service, and what nurseries must check themselves.
- Guide · Early years
Social media policy for a nursery: staff, parents, photos and pages
What a nursery social media policy should cover under the EYFS 2026: the setting’s pages, photo consent, staff accounts, parents’ posts and devices.
- Guide · Early years
GDPR for nurseries and childminders: what the law asks of you
How UK GDPR applies to nurseries and childminders in England: the ICO fee, privacy notices, lawful basis, photos, parents' requests and data breaches.
- Guide · Early years
Notifying Ofsted of changes: what early years providers must report
The changes and events nurseries and childminders in England must notify to Ofsted, the 14-day deadline, how to notify, and the record to keep.
Guides for other organisations
Why we write these
We sell a channel your organisation owns, on the record from the first message, filing into your own Microsoft 365. That is a narrow product, and it only makes sense against a duty you already carry. So we write the duties up honestly, cite the regulator rather than ourselves, and say plainly where our product is not the answer.
Every guide is a summary and none of them is legal advice. Where a decision turns on the detail, take proper advice.
How it works · Why us · Pricing · FAQ · Open a channel yourself