Nursery record keeping requirements

The rule: section 3 of the EYFS and the records it names

The Early Years Foundation Stage statutory framework for group and school-based providers, in force from September 2026, is the legal basis: every registered early years provider must meet its safeguarding and welfare requirements, and Ofsted (or a childminder agency) inspects against them. Paragraph 3.3 says the section exists so that providers “safeguard children; ensure the people who have contact with children are suitable; promote good health; support and understand behaviour; [and] maintain records, policies, and procedures”. Paragraph 3.95 is the general duty: “Providers must maintain records, obtain and share relevant and accurate information (with parents and/or carers, other professionals working with the child, the police, social services and Ofsted or their CMA, as appropriate). This is to ensure their setting is safe and efficiently managed, and the needs of all children are met.” Providers “must enable a regular two-way flow of information with parents and/or carers”, and “if requested, providers should incorporate parents’ and/or carers’ comments into children’s records”.

Two rules govern every record. Paragraph 3.96: “Records must be easily accessible and available (these may be kept securely off the premises). Confidential information and records about staff and children must be held securely and only accessible and available to those who have a right or professional need to see them.” Paragraph 3.97: “Parents and/or carers must be given access to all records about their child, provided that no relevant exemptions apply to their disclosure under the Data Protection Act.” And paragraph 3.98 sets retention in a sentence that hands the decision back: “Records relating to individual children must be retained for a reasonable period of time after they have left the provision”, with the footnote “individual providers should determine how long to retain records relating to individual children”.

Schools with nursery classes meet the same requirements, and paragraph 3.5 says they “are not required to have separate policies to cover EYFS requirements provided the requirements are already met through an existing policy”. Everyone else keeps the records this guide lists.

The main safeguarding and welfare records, with their paragraphs

In the order the framework names them:

1. The safeguarding policies and procedures, in writing (3.5: “these policies and procedures should be recorded in writing”), covering at least the five things paragraph 3.6 lists: the action on safeguarding concerns about a child; the action on an allegation against a member of staff; how mobile phones, cameras and other imaging devices are used in the setting; the procedures for checking new recruits; and how safeguarding training is delivered and supported. The whistleblowing procedure (3.7) sits with them.
2. The staff record (3.18): “Providers must record information about staff qualifications and the identity checks, vetting processes and references that have been completed (including the criminal records check reference number, the date a check was obtained and details of who at the setting obtained it).” Keep the check details rather than a routine permanent copy of the certificate; handle any temporary certificate retention under DBS guidance.
3. The medicines record (3.62): written permission from the parent for that particular medicine, and “a written record each time a medicine is administered to a child”, with parents told the same day.
4. The physical intervention record (3.76): “a record of any occasion where physical intervention is used”, with parents told the same day.
5. The accident, injury and first-aid record (3.78): “Providers must keep a written record of accidents or injuries and first aid treatment”, with parents informed the same day or as soon as reasonably practicable.
6. The information about each child (3.99): full name; date of birth; the name and address of every parent or carer known to the provider; information about any other person with parental responsibility; which parent or carer the child normally lives with; and emergency contact details, with “more than two emergency contact numbers for each child” where possible.
7. The complaints record (3.101): a written procedure for concerns and complaints, and “a written record of any complaints, and their outcome”; written complaints about EYFS requirements are investigated, the complainant told the outcome “within 28 days”, and the record is available to Ofsted on request.
8. The information about the provider (3.104): the name, residential address and telephone number of the provider and anyone living or employed on the premises; the same for anyone who will regularly be in unsupervised contact with the children; “a daily record of the names of the children being cared for on the premises, their hours of attendance and the names of each child’s key person”; and the certificate of registration, displayed.
9. The absence record (3.11): providers “must follow up on absences in a timely manner” and “consider patterns and trends in a child’s absences”, which cannot be done without a register that records them and the contact made.

Around those sit the records that other paragraphs assume: the risk assessments the premises and outings paragraphs require, the SEND records for a child with additional needs, the food and allergy information, the fire and first-aid training certificates (paediatric first aid renewed every three years), and the concern records the safeguarding policy generates, which have their own guide linked below.

What must reach Ofsted, and by when

Several records exist because Ofsted must be told, and the framework gives the clock in each case. Paragraph 3.10: registered providers “must inform Ofsted, or the CMA … of any allegations of harm or abuse by anyone living, working, or looking after children at the premises”, whether alleged to have happened “on the premises or elsewhere, for example, on a visit”, and “of the action they have taken in response”, “as soon as is reasonably practicable, but in any event within 14 days of the allegations being made. A registered provider who, without a reasonable excuse, fails to do this, commits an offence.” Paragraph 3.79: “any serious accident, illness, or injury to, or death of, any child while in their care, and of the action taken”, again within 14 days and again an offence to omit, with local child protection agencies also notified. Paragraph 3.105 lists the changes to notify – premises, the people aged 16 and over living or working on domestic premises, the manager, overnight care, and “any significant event which is likely to affect the suitability of the early years provider to look after children” or of “any person who cares for/is in regular contact with children on the premises” – and paragraph 3.106 sets the same fourteen days for a change of person, with the new person’s name, former names, date of birth and address.

Ofsted’s guidance on significant events gives the examples the framework does not: “involvement with safeguarding partners and statutory agencies about incidents or concerns that might affect someone’s suitability”, “a device containing children’s information being stolen”, “a child was able to leave a setting or was missing for any period”, “a child was not adequately supervised”, “an unauthorised person gained access to the childcare premises”, and events in staff’s own lives – domestic abuse, self-harm, arrests – because “we need to know about these events, even if they happen when you are not working with children”. The test it offers: “the greater the risk to children posed by the significant event, the more likely it is that you should notify us.” Every notification is a record in its own right: the date, what was sent, the reference, and the action taken.

What inspectors ask to see from September 2026

Ofsted’s inspection information for use from September 2026 separates what a setting must provide from what it may be asked for. Inspectors “must be able to access, either online or in printed form, information that relates to: paediatric first-aid arrangements; Disclosure and Barring Service (DBS) records and any other documents summarising the checks on, and the vetting and employment arrangements of, all staff working at the setting – this includes volunteers who engage in regulated activity with children”. Then, during the inspection, they “may need to see the policies required by the EYFS, and other relevant information, such as: referrals made to the local authority designated officer for safeguarding, and their resolution; details of all children who are an open case to social care/children’s services and for whom there is a multi-agency plan; children present at the setting during the inspection (if not shown on the register); records of accidents; records where children have been refused a place; logs of incidents of discrimination, including racist incidents; records of any complaints and their resolution”.

The tone of the renewed inspection matters for how the records are kept. Ofsted says settings “do not need to provide evidence for the inspection beyond what we ask for”, that it does “not expect leaders to produce written evidence to support each standard”, and that it does “not require photographic evidence of what children are doing and learning”. The records above are asked for because the framework requires them, and “it is likely that the inspector will cover the matters relating to them during discussions” – which means the manager has to know them, not only own them. A register that shows who was in the building and which adult was responsible for each child, a staff record that shows every check with its date, and a complaints record that shows outcomes within 28 days are the three that decide most inspections that go wrong on records.

Access, confidentiality and retention

The framework’s data protection rules are short and strict. Records about staff and children are “only accessible and available to those who have a right or professional need to see them” (3.96); every member of staff must “understand the need to protect the privacy of the children in their care” (3.97); and parents have access to “all records about their child” unless a Data Protection Act exemption applies (3.97, with the footnote reminding providers that a professional “will need to give careful consideration as to whether the disclosure of certain information about a child could cause harm either to the child or any other individual”). Providers “must be aware of their responsibilities under the Data Protection legislation” (3.96), which in practice means a privacy notice for parents, a lawful basis for each record (consent is rarely the right one; the framework’s own requirements and the setting’s legitimate interests usually are), security that fits the sensitivity of personal information about children and families, and the special-category conditions for health and safeguarding information under the Data Protection Act 2018 and UK GDPR.

Paragraph 3.98 requires a reasonable period after a child leaves; it does not prescribe one retention period for every record. Set a schedule by record type, taking account of safeguarding guidance, insurance and contractual requirements, possible claims and data protection. Do not use a child’s 21st birthday as a universal cut-off: limitation rules have exceptions and some records need longer retention. Child protection records need a separate schedule informed by specialist guidance, including the NSPCC recommendations. Preserve records subject to a legal hold or an applicable inquiry direction, and record the reasons for extended retention and eventual disposal.

The record that forms in staff messages

Every record above is written by a practitioner after something happened, and almost everything that happens in a nursery is now first told in a message. The room leader tells the manager about a bump on the head in the staff WhatsApp because the manager is in the baby room. The practitioner who is worried about a child’s bruises messages a colleague at the end of the shift. The deputy asks an authorised colleague to check the medicines record. The parent who complains does so by text to the key person’s personal number, and the reply – the setting’s first response to a complaint – is sent from the same phone. The accident record, the medicines record, the complaints record and the concern record are all written later, from those messages, by whoever remembers.

The framework requires records that are accurate, kept securely, accessible only to those with a right to see them, and available to Ofsted; the first version of each of those records is on personal phones, in an app the setting does not run, visible to everyone in the group and to nobody at Ofsted. When an allegation is notified within fourteen days, the question “what was known and when” is answered from screenshots. When a parent asks under paragraph 3.97 for all records about their child, the messages about the child in the staff group are records too, and the setting cannot search them.

Use a restricted reporting route, with access limited to the people who need the information. A recorded message is not proof that someone has read or acted on a concern: follow the safeguarding procedure, contact the responsible person directly when action is urgent, and use the local authority or emergency route when required. Add the relevant information and decisions promptly to the formal safeguarding record.

The remedy is not to forbid staff from telling each other what happened; a nursery runs on it. It is to give those first tellings an approved communication route that follows the setting’s mobile-phone policy and does not interrupt supervision, where the manager is in the conversation from the first message, where everyone in it has been told it is on the record, and where the message that becomes the accident record or the concern record is kept as it was sent. The question for the manager and the owner is whether the setting could produce, today, the conversation in which yesterday’s incident was first reported.

Official guidance and your next step

The primary sources are the EYFS statutory framework for group and school-based providers (from September 2026; section 3, paragraphs 3.3 to 3.11, 3.18, 3.62, 3.76 to 3.79 and 3.95 to 3.107), Ofsted’s early years inspection information and its significant events guidance, the ICO’s guidance for early years providers, and the local safeguarding partnership’s procedures the framework requires policies to follow. The Early Years Alliance and the NSPCC publish templates for the concern and accident records.

This guide is a summary of published guidance for England, not a substitute for it and not legal advice. Providers on the Childcare Register only, and childminders, have their own requirements; the childminder framework is covered in the guide linked above.

Then do one thing: take the list in section two and, for each record, write down where it is kept and who last wrote in it. Any record whose honest answer is “the group chat, then the folder” is the one to move.