Nursery staff WhatsApp groups

The rule: what the EYFS says about a nursery staff WhatsApp group

The EYFS does not mention WhatsApp and does not ban personal phones; it requires a safeguarding policy that answers for them. The EYFS statutory framework for group and school-based providers, dated 13 July 2026 and in force from 1 September 2026, says at paragraph 3.5 that providers “must have and implement policies and procedures to keep children safe and meet EYFS requirements”, which “should be recorded in writing” and be “in line with the guidance and procedures of the relevant Local Safeguarding Partners”. These paragraphs of section 3 reach a staff group directly:

• Devices (3.6). Safeguarding policies must include “How mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting.” A group on staff phones is exactly that.
• Concerns and allegations (3.6). The same policy must set out “The action to be taken when there are safeguarding concerns about a child” and “The action to be taken in the event of an allegation being made against a member of staff.” Neither route can be the group.
• The safeguarding lead (3.4). “In every setting, a practitioner must be designated to take lead responsibility for safeguarding children”, and every person looking after children must be alert to any issues of concern.
• Whistleblowing (3.7). Providers must have whistleblowing procedures for all staff, “including students and volunteers”, and “must ensure all staff feel able to raise concerns about poor or unsafe practice and know that such concerns will be taken seriously by the senior leadership team”.
• Confidentiality (3.96 and 3.97). Confidential information and records about staff and children “must be held securely and only accessible and available to those who have a right or professional need to see them”, and providers must ensure all staff understand the need to protect the privacy of the children in their care.

The difference between “must” and “should” is legal, not stylistic. Regulation 3 of the Early Years Foundation Stage (Welfare Requirements) Regulations 2012 makes the “must” provisions of section 3, apart from a few it lists, the welfare requirements, and requires providers to have regard to its “should” provisions. The duty to notify Ofsted of allegations sits in regulation 8 and the Schedule instead.

Childminders work to the EYFS statutory framework for childminders, which carries the same devices clause at paragraph 3.7. A childminder registered solely on the Early Years Register, or with an early years childminder agency, need not write policies down, but “must be able to explain their policies and procedures to parents, carers, and others” and must ensure any assistants follow them (paragraph 3.6). A childminder whose assistants share a WhatsApp group still needs a rule for it, even if the rule is spoken rather than written. Paragraph numbers elsewhere in this guide are from the group framework; in the childminder framework whistleblowing is 3.8, concerns 3.10, allegations 3.11 and confidentiality 3.95 and 3.96.

Nursery and reception classes run by a school work to the same group and school-based framework, and the EYFS adds that schools must have regard to Keeping children safe in education 2026, which other childcare providers “may also find it helpful to read”. A school with a nursery class should read this guide beside our guide to staff WhatsApp groups in schools, which covers the school side.

The EYFS applies in England. Nurseries and childminders in Wales, Scotland and Northern Ireland work to their own national standards, and the safeguarding points below should be checked against them.

What a nursery staff WhatsApp group carries within a month

The group is not misconduct; it is a team doing its job with the only tool everyone already has. The question is what it ends up holding, and who can see it. A typical nursery or pre-school staff group soon carries:

• Rota, sickness and cover, including a colleague's reason for being off, which may be health information about her.
• Children's names and details: “is Ella in tomorrow?”, “Mum says Oscar's had a temperature”, the allergy list for the trip, a note that a family has asked for no photographs.
• Photographs forwarded from a phone for the newsletter or the display, with other children in the frame. Our social media policy guide covers photo consent and the images that never reach the setting's tablet; this guide does not repeat it.
• Parents' complaints, relayed as they arrive and discussed by the whole team before the manager has replied.
• The first sign of a concern: “has anyone else noticed how quiet he's been?” or a remark about how a colleague spoke to a child.
• People who should not still be there: bank and agency staff added for one week's cover, students and apprentices whose placement ended, practitioners who left last year, and an owner who never works in the rooms.

Paragraph 3.96 requires that confidential information about children is seen only by “those who have a right or professional need to see them”. A group of every member of staff past and present, receiving every message about every child, fails that test by design, however well the people in it behave. The setting is also the data controller for work messages about children, wherever they are held, which our guide to GDPR for nurseries and childminders explains. Where personal phones sit during sessions is a separate question, covered in our personal mobile phone policy guide.

Concerns, allegations and images posted in the staff group

A concern about a child. Paragraph 3.9 of the EYFS says that if providers have concerns about children's safety or welfare, “they must immediately notify their local authority children's social care team, in line with local reporting procedures, and, in emergencies, the police.” The route to that notification is the setting's own procedure, through the designated safeguarding lead. A concern that first appears in the group should be taken out of it at once: the practitioner tells the DSL directly, the DSL makes the record of concern, and the group discusses it no further. Posting it in the group is not reporting it, and twenty replies with a sad face do not make it anyone's job. What the record should contain is in our guide to early years safeguarding records.

An allegation against a member of staff. Paragraph 3.10 requires registered providers to inform Ofsted (or, for childcare on domestic premises registered with a childminder agency, that agency) of “any allegations of harm or abuse by anyone living, working, or looking after children at the premises”, and the action taken, “as soon as is reasonably practicable, but in any event within 14 days of the allegations being made”. A provider that fails to do so without a reasonable excuse commits an offence. Since 1 September 2026 the threshold has been harm, not serious harm: the word “serious” was removed from paragraph 4(1) of the Schedule to the 2012 Regulations, as the DfE's summary of changes to the EYFS framework confirms. Working Together to Safeguard Children 2026 adds that the local authority designated officer (LADO) “should also be informed within one working day of all allegations that come to an employer's attention or that are made directly to the police” (paragraph 264). A staff group is the worst place for an allegation to surface: the person it concerns may well be a member, and the conversation can alert them before anyone has acted.

Concerns about a colleague online. The UK Council for Internet Safety's guidance for early years practitioners, Safeguarding children and protecting professionals in early years settings: online safety considerations, says: “If you are concerned about the behaviour of a colleague online, follow your allegations procedures and report and record to your DSL or your manager. If you are unhappy with the response you receive, follow your settings whistleblowing policy.” It was published in February 2019 and refers to the 2017 EYFS, so treat it as guidance, not current statutory wording; the 2026 framework still suggests providers may find it helpful.

Images. Annex C of the EYFS requires every practitioner's safeguarding training to cover identifying signs of possible abuse, harm and neglect, and gives “inappropriate behaviour from practitioners” as one, which “could include … inappropriate sharing of images”. If an indecent image of a child is ever shared, the UKCIS guidance is unambiguous: “do not print, forward, save or share these images (this is illegal); report concerns immediately to your DSL.” That includes forwarding it to the manager as evidence; Keeping children safe in education 2026 says staff “should not view or forward illegal images of a child” (paragraph 558).

What tribunals have read in nursery staff WhatsApp groups

Nursery staff groups are already in the case law. Our register of UK WhatsApp cases summarises fifteen early years entries, from a pre-school downgraded over photographs texted to parents to unpaid wages found from messages the claimant read out. Three of them bear directly on a staff group's rules:

• Prepared answers before Ofsted's staff interviews. In August 2026 the First-tier Tribunal (Care Standards), in [2026] UKFTT 1115 (HESC), confirmed Ofsted's cancellation of the registration of a nursery company with three settings. Among eight issues, it found that prepared safeguarding answers sent to the staff WhatsApp group the day before Ofsted interviewed staff were coaching: “The overall aim was to mislead the regulator in its assessment.” It also found that a main DSL living abroad for a long period and contactable only by WhatsApp or email had made arrangements that “were not secure”. The cancellation rested on all the issues together, not on the message alone.
• Leaving a manager out of the group. In an employment tribunal judgment of 14 May 2026 (case 6012669/2025), a pre-school's operations manager, acting as DSL, had made protected disclosures to Ofsted, the LADO and the ICO. A director then set up a new staff WhatsApp group that left her out, which the judge found “a detriment as it was excluding the claimant from work place communications”. The same judgment records a director sending staff WhatsApp messages during an Ofsted visit about the inspectors' movements. The employer did not respond to the claim or attend, so these findings were not tested.
• A staff group that mixed work and personal life. In a 2025 judgment about a charity-run pre-school (case 2200448/2024), the tribunal called a WhatsApp group of the manager, deputy manager and two practitioners “a perfect example of how to unprofessionally blur the boundaries between the workplace and personal relationships”. All the claimant's claims failed, but the group's messages were still examined and described in a public judgment.

Each lesson is one the EYFS already points to: a DSL reachable by a route that is actually secure (paragraph 3.4), nobody cut off after raising a concern (paragraph 3.7), and staff who answer an inspector from their own knowledge – the tribunal said that “If staff were secure in their safeguarding knowledge they would not need to be prepared in this way.” In each case the group was read by people outside it.

What a nursery staff WhatsApp policy should say

A ban that everyone ignores is worse than a rule people follow, because it moves the group out of sight. Write a short policy with the room leaders who run the current group, give every job the group does an approved route, and put it inside the safeguarding policy that paragraph 3.6 already requires. It should say:

1. The official route for anything that matters. The UKCIS guidance for managers says communication with colleagues “should be professional and take place via official setting communication channels e.g. work provided emails/numbers”. Name the routes for rota changes, sickness, messages from parents and anything about a child.
2. No children in the group. No names, initials, photographs, health, behaviour or family details in any group the setting does not control. Logistics are fine; children are not.
3. Concerns and allegations go straight to the DSL, by the route in the safeguarding policy, and never into the group. Say what to do if one has already been posted: tell the DSL directly, and stop discussing it in the group.
4. No prepared or suggested answers before an inspection, and no running commentary on inspectors during one.
5. Nobody left out after raising a concern. Removing or excluding someone from staff communications after a concern can be a whistleblowing detriment; link the rule to the setting's whistleblowing policy.
6. Membership and leavers. Who administers each group, who approves additions, and who removes leavers, students and bank staff on their last day. Say what is expected of a leaver about messages already on her phone.
7. Joining is optional, and every notice also goes by the official route, so a practitioner without a smartphone, or who keeps her number private, misses nothing she needs for her next shift.
8. Hours. When messages are expected and when they are not, and the separate route for something genuinely urgent. The EYFS sets no rule on this, so it is the setting's decision to make and write down.
9. Wrong group, lost phone. The ICO's guide to personal data breaches lists “sending personal data to an incorrect recipient” and lost or stolen devices among them. Staff report either to the manager at once; the setting records every breach, and reports a notifiable one to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. The ICO has been the Information Commission since 30 September 2026 (SI 2026/1015). Our nursery data breach guidance has the detail.
10. Conduct, and what happens when a rule is broken, connected to the staff code of conduct and disciplinary procedure. The clauses on harassment between colleagues and by parents are in our WhatsApp policy for employees guide.

The conversation the setting cannot produce

A policy can stop children's names going into the group. It cannot make the group a record. The messages a regulator or tribunal later asked about in the cases above – the prepared answers, the new group that left someone out, the messages about inspectors' movements – were all held in WhatsApp on people's own phones, not in a system the setting controlled. In an end-to-end-encrypted consumer app that is by design: the setting cannot search the messages, keep them under its own retention schedule, or show Ofsted from its own system what staff were told and when.

That is why the lasting fix is a different place for the conversation, not a stricter rule. ComplyChat replaces the staff WhatsApp group with channels the setting controls. Everyone added is told the channel is on the record and can object or leave, and messages are recorded on the server as they are sent rather than gathered from phones afterwards. A mobile number verified by SMS is an identity on it, so bank staff and students without a work email can be included, and removing a leaver from the setting's organisation signs her out and removes her passkeys, so her access ends there. On paid plans, once the setting's Microsoft 365 tenant is connected, conversations are kept under the retention schedules it already runs within its own Microsoft 365 subscription; a small setting may not have one, and Free, a permanent personal tier, does not meet a retention duty. ComplyChat cannot read or retrieve anything from staff members' existing WhatsApp groups, so changing tools does not recover what is already there. It is not a nursery management system or a learning journal, and does not do rotas, registers or invoices.

A question for the next managers' or owners' meeting: if Ofsted asked to see what staff were told about safeguarding this month, could the setting show it from a system it controls, or would it have to ask to see someone's phone?

Questions people ask

Can nursery staff have a WhatsApp group?

Yes. No law or EYFS paragraph bans a nursery staff WhatsApp group, but the safeguarding policy must say how phones and other devices “with imaging and sharing capabilities” are used (EYFS paragraph 3.6), and confidential information about children must be held securely and seen only by those with a right or professional need to see it (paragraph 3.96).

Can nursery staff share photos of children on WhatsApp?

The EYFS does not ban it outright, but it requires the setting's safeguarding policy to govern how devices “with imaging and sharing capabilities” are used (paragraph 3.6), and Annex C gives “inappropriate sharing of images” as an example of practitioner behaviour that staff training must help them recognise. The UKCIS early years guidance says communication with colleagues should go through official setting channels.

What should a nursery do if a safeguarding concern is posted in the staff WhatsApp group?

Take it out of the group and act on it under the setting's safeguarding procedures, through the designated safeguarding lead. The provider must “immediately notify” children's social care of a concern about a child (EYFS paragraph 3.9); an allegation of harm or abuse by anyone living, working or looking after children at the premises must be notified to Ofsted as soon as reasonably practicable and within 14 days (paragraph 3.10), and Working Together 2026 says the LADO should be informed within one working day (paragraph 264).

Can a nursery leave a member of staff out of the staff WhatsApp group?

Not as a response to a concern. In a May 2026 employment tribunal judgment, a pre-school director set up a new staff WhatsApp group that left out the operations manager after she made protected disclosures to Ofsted, the LADO and the ICO, and the judge found it “a detriment as it was excluding the claimant from work place communications” (the employer did not defend the claim). EYFS paragraph 3.7 requires providers to “ensure all staff feel able to raise concerns”.

Can WhatsApp messages be used against a nursery by Ofsted or a tribunal?

Yes. In August 2026 the Care Standards tribunal, confirming Ofsted's cancellation of a nursery company's registration on several grounds, found that prepared answers sent to the staff WhatsApp group the day before Ofsted's staff interviews were “coaching” whose “overall aim was to mislead the regulator”.

Does a childminder need a WhatsApp policy for assistants?

A childminder needs the rule, if not always the document. The EYFS framework for childminders requires safeguarding policies to cover how phones and other devices with imaging and sharing capabilities are used (paragraph 3.7); a childminder registered solely on the Early Years Register or with an early years childminder agency need not write policies down, but must be able to explain them and must ensure any assistants follow them (paragraph 3.6).

Official guidance and your next step

The primary sources are the EYFS statutory frameworks for group and school-based providers and for childminders, in force from 1 September 2026 (paragraphs 3.4 to 3.10, 3.96, 3.97 and Annex C of the group framework; paragraphs 3.6 and 3.7 of the childminder framework), the Early Years Foundation Stage (Welfare Requirements) Regulations 2012, Working Together to Safeguard Children 2026, Keeping children safe in education 2026, the DfE's summary of changes to the EYFS framework, the UKCIS early years online safety guidance for managers and practitioners, and the ICO's guide to personal data breaches. The tribunal decisions are linked above and summarised with others in our case register. Quotations are from those sources as published on 30 October 2026.

This guide is a practical starting point for nurseries, pre-schools and childminders in England, not legal or HR advice about an individual employee, concern or breach. Your Local Safeguarding Partners' procedures come first where they say more.

Then do one thing: ask your room leaders, without blame, which WhatsApp groups exist for work in your setting, who is in each, and who administers them. Write the answer down; it is the starting list for the policy.