Safeguarding training records

Who must be trained, and what each regime says about the record

Schools and colleges. Keeping children safe in education 2026 (KCSIE), the statutory guidance in force from 1 September 2026, puts the duty on governing bodies and proprietors: they “should ensure that all staff undergo safeguarding and child protection training (including online safety which, amongst other things, includes an understanding of the expectations, applicable roles and responsibilities in relation to filtering and monitoring …) at induction. The training should be regularly updated. Induction and training should be in line with any advice from local safeguarding partners” (paragraph 153). Paragraph 154 adds the annual cycle: “all staff should receive regular safeguarding and child protection updates, including online safety (for example, via email, e-bulletins, staff meetings) as required, and at least annually”. Governors and trustees “should ensure that all governors and trustees receive appropriate safeguarding and child protection (including online) training at induction” and that “their training should be updated regularly” (paragraph 87). The designated safeguarding lead (DSL) and any deputies “should undergo training to provide them with the knowledge and skills required to carry out the role. This training should be updated at least every two years”, they “should also undertake Prevent awareness training”, and their knowledge “should be refreshed … at regular intervals, as required, and at least annually” (Annex C). Anyone involved in recruiting staff to work with children should have “appropriate safer recruitment training, the substance of which should at a minimum cover the content of this part (Part three)” (paragraph 288), and in maintained schools and pupil referral units the law requires that “at least one of the persons who conducts an interview has completed safer recruitment training” (paragraph 289, citing the School Staffing (England) Regulations 2009).

KCSIE also says where the record may live. The single central record has a short statutory list of columns, and paragraph 352 then says schools “are free to record any other information they deem relevant”, giving as an example “dates on which safeguarding and safer recruitment training was undertaken”. And one training-adjacent record is required in terms: the annual review of filtering and monitoring “should include checks that filtering is working appropriately on all internet-connected devices in all relevant locations, and a record should be kept of these checks” (paragraph 173).

Charities. The Charity Commission’s Safeguarding and protecting people for charities and trustees expects every trustee board to make sure the charity “has enough resources, including trained staff/volunteers/trustees for safeguarding and protecting people” and “keeps accurate records”. A charity that works with children or adults at risk should “make sure all staff and volunteers receive regular training on child protection or working with adults at risk”. The tools the Commission lists for trustees’ assurance include “setting training plans for trustees, staff and volunteers on safeguarding and protecting people from harm”, and its ten actions for boards end with “regularly evaluate any safeguarding training provided, ensuring it is current and relevant”. Nothing in that guidance names a cycle; the cycle is the charity’s own policy, and the record is what shows the policy was followed.

Adult social care. Regulation 18(2)(a) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires that staff “receive such appropriate support, training, professional development, supervision and appraisal as is necessary to enable them to carry out the duties they are employed to perform”. The Care Quality Commission’s (CQC’s) guidance on Regulation 18 turns that into a cycle and a record: providers “must ensure that they have an induction programme that prepares staff for their role”; “training, learning and development needs of individual staff members must be carried out at the start of employment and reviewed at appropriate intervals during the course of employment”; staff should be able to take part in “statutory training”, “other mandatory training, as defined by the provider for their role” and “any additional training identified as necessary to carry out regulated activities”, including “first aid training for people working in the adult social care sector”; and “all learning and development and required training completed should be monitored and appropriate action taken quickly when training requirements are not being met”. Regulation 17(2)(d) then requires the provider to “maintain securely such other records as are necessary to be kept in relation to persons employed in the carrying on of the regulated activity”, and CQC’s guidance on Regulation 17 says those records “must include information relevant to their employment in the role” and that “this applies to all staff, not just newly appointed staff”. Schedule 3 adds, for every person employed, “satisfactory documentary evidence of any qualification relevant to the duties for which the person is employed”.

Three regimes, one shape: a duty to train at induction, a duty to keep the training current, and a duty to be able to show both. The record is the only thing that turns the first two into the third.

What a safeguarding training record has to show

No regulator publishes a template, and an inspector does not want one. What they want is to pick a name and see, without a search, what that person was trained in, when, by whom, when it falls due and what evidence exists. A record that answers those questions for every person, including volunteers, governors and agency staff, is a training record; a folder of certificates is not. Most organisations keep it as a spreadsheet or a training matrix in an HR or safeguarding system, and either is fine; what matters is the fields. The ones that do the work:

1. Who. Every person the duty covers, not only employees. In a school that is all staff, governors and trustees, regular volunteers and, for the reading duty, contractors who work with children; in a charity it is trustees, staff and volunteers; in a care service it is everyone employed in the regulated activity, including bank and agency workers.
2. Which training, at which level. Induction safeguarding and child protection training; the KCSIE Part one reading confirmation; the annual update; DSL or safeguarding lead training; Prevent awareness; safer recruitment; online safety and filtering and monitoring responsibilities; information sharing; and, in care, the statutory, mandatory and role-specific list the provider has defined. The name of the course and who delivered it, whether that is the local safeguarding partnership, the NSPCC, a commercial provider or the DSL in a staff meeting, so that a later question about content (did it cover neglect, or child-on-child abuse, or the new referral threshold?) can be answered.
3. Date completed and date due. The renewal interval is set by the regime or the policy: at least annually for KCSIE updates, at least every two years for the designated safeguarding lead, “regularly” for governors and charity workers, “at appropriate intervals” in care. A record with no due date cannot show currency, and currency is the point.
4. Evidence. The certificate, the attendance register, the e-learning completion report, the signed or emailed confirmation that Part one was read. Store the evidence with the record or reference it; a date with nothing behind it is a claim.
5. Who verified it, and when. The person who checked the certificate matched the course and the name, as the single central record asks for each pre-appointment check.
6. Gaps and actions. Who is overdue, what has been booked and for when. Ofsted’s operating guide allows a school to be graded “met” with a minor safeguarding improvement outstanding “where training has been booked but will not take place for a number of weeks”; that concession depends on being able to show the booking.

Two records are commonly confused with this one and are not it. The single central record is the register of pre-appointment checks; training dates may be added to it as non-statutory columns and often are, but a school that keeps them only there has a training record for staff on the SCR and none for governors, volunteers or the annual update. And the certificate file is evidence, not a record: it shows a course was passed, not who is due next month.

The cycles the record has to prove

Laid end to end, the duties above give a calendar. The record’s job is to show every line of it for every person, and the lines that most often fail on inspection are the ones with no fixed date.

• All school and college staff: safeguarding and child protection training, including online safety, at induction; updates “as required, and at least annually”; staff who work directly with children “read at least Part one” of KCSIE, and governing bodies “should now also ensure that those staff who do not work directly with children read Part one”. Most schools evidence the reading each September and after any in-year change.
• Designated safeguarding lead and deputies: formal training “updated at least every two years”, Prevent awareness training, and knowledge refreshed “at least annually”.
• Governors and trustees: training at induction, “updated regularly”; the senior board-level safeguarding lead KCSIE asks for is the obvious owner of the governors’ row.
• Recruitment panels: at least one trained member on every panel in a maintained school or PRU by law, and “those involved with the recruitment and employment of staff” trained in every setting. The evidence is per interview, not per person: which trained member sat on which panel.
• Filtering and monitoring: the annual review of provision, with “a record … kept of these checks”, and staff with “an awareness and understanding of the provisions in place”.
• Charity trustees, staff and volunteers: “regular training” where the charity works with children or adults at risk, a training plan set by the board, and periodic evaluation that the training is “current and relevant”. The cycle is whatever the safeguarding policy says, and the policy itself is reviewed “at least once a year”.
• Care staff: induction before unsupervised work, needs assessed at the start and “reviewed at appropriate intervals”, the provider’s own statutory and mandatory list, training in supporting people with a learning disability and autistic people “at a level appropriate to their role”, first aid, and supervision and appraisal where needs are “identified, planned for and supported”.

The pattern across all three regimes is that induction is dated and everything after it is a judgement of what “regular” and “appropriate” mean. Write the interval into the policy, and the record then has a due date to test against. Without that, “regularly updated” cannot be evidenced at all.

What Ofsted, CQC and the Charity Commission actually ask for

Ofsted does not put training records on the list of documents a school must have ready by 8am on day one of an inspection (that list is the single central record, volunteers’ checks, referrals and open cases; our Ofsted safeguarding evidence guide sets it out). They arrive by another route. The school inspection toolkit names, among the factors inspectors gather evidence on, “ensuring that all those who work with pupils are trained well in supporting them to be safer, and are empowered to speak out and take action when there are concerns”, and under safer recruitment asks whether leaders “receive suitable training in safer recruitment”. The operating guide tells the lead inspector to meet the designated safeguarding lead on day one and review a sample of casework, to “meet briefly with a group of staff selected at random to discuss safeguarding”, and lists the key records to review as “safeguarding records, attendance data, behaviour logs and complaints records”, adding that “they may also include training records and/or a safeguarding audit”. The safeguarding standard is graded “met” when, among other things, “all staff are vigilant and carry out their responsibilities effectively” and “staff understand the signs of possible safeguarding concerns”. The training record evidences the input; the conversation with the random group of staff tests the outcome. A record that says everyone was trained in September and a group of staff who cannot say who the designated safeguarding lead is will be read together.

CQC reads training through Regulation 18 and the staff records through Regulation 17. Its Regulation 18 guidance is explicit that completed training “should be monitored and appropriate action taken quickly when training requirements are not being met”, which is a description of a training matrix with due dates and a manager reading it. Inspectors ask to see it, and they cross-check it against the Schedule 3 file for individual staff, against supervision and appraisal records, and against what staff say when asked how they would recognise and report abuse. The safeguarding regulation itself, Regulation 13, is assessed partly on whether staff have been trained to recognise it.

The Charity Commission is not a safeguarding authority and does not inspect. It looks at how trustees acted when something comes to its attention, and its guidance says it “can check that trustees followed this guidance and the law”. For training, that means the board’s own record: the training plan it set, the standing safeguarding item at its meetings, the evaluation that the training was “current and relevant”, and the register showing who had it. A serious incident report that says “all staff are trained” with nothing behind it is exactly the claim the Commission tests.

How long to keep it, and where it lives

No statute names a retention period for a safeguarding training record as such, and the guidance around it points in two directions. KCSIE fixes periods for the neighbouring records: low-level concerns about staff, “at least until the individual leaves their employment” (paragraph 523); records of allegations against staff, “at least until the accused has reached normal pension age or for a period of 10 years from the date of the allegation if that is longer” (paragraph 500). CQC’s Regulation 17 guidance says staff records “must be created, amended, stored and destroyed in accordance with current legislation and guidance” and that providers “must observe data protection legislation about the retention of confidential personal information”. Data protection law then supplies the principle: keep personal data no longer than the purpose needs.

The purpose gives the answer. A training record exists to show that a person was competent at the time of an event, and to show a regulator the cycle was kept. So the evidence for any course must outlast the course’s validity, and the register must reach back at least as far as an inspector samples: Ofsted reviews “any incidents that have occurred since the previous inspection” and inspects most schools about once every four years; CQC and the Commission look back to the incident in question, which may be years old by the time it surfaces. A workable rule, written into the retention schedule: keep each person’s training history for the length of their engagement and for the period the organisation keeps its staff file afterwards, and keep the whole-organisation register, year by year, for the period between inspections plus one. Keep the certificate or completion evidence for as long as the entry it supports.

Where it lives matters as much as how long. Training evidence is personal data about staff, so its storage belongs with the staff file or a training register under the same access controls, not in a shared drive folder anyone can browse, and its destruction at the end of the retention period should be recorded like any other disposal. If dates are also entered on the single central record, the SCR is not the master; it is a copy, and the two must agree. Our DBS record keeping guide covers the parallel rule for certificate information, which is stricter still.

The annual update that never reached the file

Every one of these regimes has a line for the update between formal courses, and KCSIE is the most specific about how it is delivered: “via email, e-bulletins, staff meetings”, as required and at least annually. In practice a great deal of it is delivered as messages. The designated safeguarding lead posts the September reminder to a staff group: read Part one, confirm by Friday, here is the new local referral form. The volunteer coordinator sends the training date and the link to the module to the volunteers’ chat. The care home manager puts the new medication competency sign-off in the night staff’s group and asks everyone to reply done. The reply comes back as a thumbs-up and a photograph of a certificate.

Each of those is the update the guidance describes, and each is a record of it: who was told what, when, and who confirmed. Almost none of it is anywhere the organisation controls. It sits on personal phones in an app the school, charity or care service does not run, and it leaves when the phone does. When an inspector asks how staff were updated on the change to the low-level concerns policy, the honest answer is often “it went round on the group”, and the register shows a formal course from two years ago and nothing since.

The fix is not to stop the messages; they are the fastest and most reliable way the update reaches people, and a policy banning them would move them rather than end them. It is to send them on a channel the organisation owns, so that the reminder, the link and the “done” replies are in the record with a date beside them, and the training register can point at them. Two limits, stated plainly and including for products like ours: nothing lawful can read a member of staff’s personal phone or recover a group chat that has already happened, and no channel turns a message into training; the course still has to be taken and the certificate still has to be checked.

A question for the next leadership or trustees’ meeting: take the last safeguarding update sent to all staff. Can the organisation show who received it, who confirmed, and who did not, from a record it holds?

Official guidance and your next step

The sources are Keeping children safe in education 2026 on GOV.UK (paragraphs 12 to 14 and 153 to 157 for staff, 87 for governors, 288 to 289 for safer recruitment, 173 for filtering and monitoring, 352 for the single central record, and Annex C for the designated safeguarding lead); Ofsted’s school inspection toolkit, operating guide and information for schools, for use from September 2026; the Charity Commission’s Safeguarding and protecting people for charities and trustees; and CQC’s guidance on Regulation 18 and Regulation 17 with Schedule 3 of the 2014 Regulations. Your local safeguarding partnership or safeguarding adults board publishes the training expectations and courses for your area, and KCSIE says induction and training should follow its advice.

This guide is a practical starting point for designated safeguarding leads, headteachers, trustees and registered managers in England, not legal advice about an individual case or person. Where a question concerns a specific concern or allegation, follow your own procedures and speak to your safeguarding lead.

Then do one thing: take your training register and pick five names at random, including a governor or trustee, a volunteer and someone who started this year. For each, can you show the induction date, the last update, the next due date and the evidence, without asking anyone?