ComplyChat guides · 90 guides
Guides for schools and academy trusts
A school answers to several rulebooks at once: Keeping children safe in education, the DfE’s governance guides, the Academy trust handbook, UK GDPR and the Ofsted inspection toolkit. These guides take each duty in turn, quote the official wording, and say what record you should be able to produce when an inspector, a parent or a court asks for it.
Where to start
- Keeping children safe in education: what KCSIE requires you to recordKCSIE 2026 in outline: the five parts, what changed from 2025, and the records it expects schools to keep – and where they should live.
- Single central record requirements: what it shows, who goes on itWhat KCSIE 2026 requires on the single central record: who must be on it, the seven checks and their dates, agency staff, volunteers and what inspectors check.
- Statutory policies for schools: the 2026 list, law by lawThe statutory policies and documents a maintained school or academy trust in England needs, the law behind each, who approves it, the review cycle and what goes on the website.
- GDPR in schools: what UK data protection law actually requiresData protection in schools under UK GDPR: who the data controller is, the DPO a school must appoint, lawful basis, biometrics, SARs and 72-hour breaches.
- Ofsted safeguarding evidence: what inspectors ask for, and whenOfsted safeguarding evidence for September 2026: the ‘met’ standard, the 8am document list, day-one SCR and DSL checks, and the record inspectors read.
- Staff WhatsApp groups in schools: the rules and the staff policyCan a school require staff to join a WhatsApp group? The safeguarding and data protection risks, disciplinary use of messages and what a staff policy says.
Governance and the board
- Guide · Governance
Minute taking: what to record and what to leave out
What belongs in meeting minutes and what does not, who should take them, a reusable structure, and why the minute book no longer sees every decision.
- Guide · Governance
Board minutes retention: how long to keep minutes, who is entitled to see them, and what the record has to prove
Board minutes retention for charities, schools and care providers in England: the ten-year rule for companies under the Companies Act 2006, the six-year rule for CIOs, what a maintained school governing body and an academy trust must make available for inspection, what the minutes are evidence of, the form the record may take, and the decisions made between meetings that never reach it.
- Guide · School governance
Chair of governors: responsibilities and powers
What a chair leads and what they do not, the powers the role actually carries, what chair's action means and when it may be used, and whether a chair can suspend a headteacher.
- Guide · Charity governance
Code of conduct for trustees: contents, adoption and breaches
A trustee code of conduct for a charity or academy trust: whether it is required, what the 2025 Charity Governance Code expects, what to include, and breaches.
- Guide · Charity governance
Trustee email retention: what to keep, for how long, and leavers
Trustee email in charities, schools and academy trusts: whose record it is, why personal addresses fail, SARs and FOI, how long to keep what, and leavers.
- Guide · School governance
Governor code of conduct: what to include, and handling a breach
What a governor code of conduct should say in a maintained school or an academy local committee: the DfE expectation, the Nolan principles, suspension and removal.
- Guide · School governance
Local governing body: the LGB's role in a multi-academy trust
What a local governing body is in a multi-academy trust, what the scheme of delegation lets it decide, who sits on it, and what its minutes must record.
- Guide · School governance
Governor training: what the DfE expects, and the record to keep
What the DfE governance guides and KCSIE 2026 expect on governor induction and training, which training is specific to a role, and what boards should record.
- Guide · School governance
Academies Financial Handbook, now the Academy Trust Handbook 2026
The Academies Financial Handbook is now the Academy Trust Handbook. What the 2026 edition requires from 1 October, what changed, and the records behind it.
- Guide · Governance
Grievance procedure: the Acas Code steps and what to record
A grievance procedure under the Acas Code: what a grievance is, the steps, the meeting, accompaniment, the outcome and appeal, what to record, and tribunal time limits.
- Guide · School governance
Statutory policies for schools: the 2026 list, law by law
The statutory policies and documents a maintained school or academy trust in England needs, the law behind each, who approves it, the review cycle and what goes on the website.
- Guide · Charity governance
Trustee decisions between meetings
How trustees can decide between meetings: written resolutions, chair’s action, delegation, voting rules and the evidence to retain.
- Guide · Charity governance
Trustees WhatsApp group: what it can and cannot be used for
What a trustees or governors WhatsApp group can be used for, when a decision in it is valid, and what it means for conflicts, personal data, SARs and leavers.
- Guide · Governance
Risk register: what it records and what the regulators expect
What a risk register is, what it should include, how likelihood and impact scoring works, and what CC26, the Academy Trust Handbook and CQC expect of boards.
- Guide · Schools
Ofsted toolkit: the school inspection toolkit and framework, 2026
The Ofsted school inspection toolkit for September 2026: the evaluation areas, the five-point scale, report cards, and the evidence leaders and governors show.
- Guide · Charities
PTA constitution: clauses, officers and the records to keep
What a school PTA constitution must cover, the Charity Commission model documents, the £5,000 registration threshold, officers, AGMs and the records to keep.
- Guide · School governance
Academy trust members: powers, limits and the records a trust keeps
What academy trust members do under the Academy trust handbook 2026, how they differ from trustees and local governors, and the records a trust keeps of them.
- Guide · School governance
Academy trust governance documents: what to hold and publish
The governance documents an academy trust must hold and publish – articles, funding agreements, schemes of delegation, registers – and keeping them current.
- Guide · School governance
School complaints policy: the DfE stages, the panel and the record
What a school complaints procedure must contain in England: section 29 and Part 7, the DfE's recommended stages, the panel hearing and the complaint record.
- Guide · Safer recruitment
Section 128 check: who needs one, how to run it and what to record
The section 128 check under KCSIE 2026: who needs one in academies, independent and maintained schools, how to run it, and what goes on the record.
- Guide · School governance
Governor induction: the first term, the pack and the induction record
How to induct a new school governor or academy trustee in England: what the DfE expects, a first-term programme, the induction pack and the record to keep.
- Guide · School governance
Governor visits record: planning the visit and writing the report
How school governors plan a monitoring visit, what the governor visit report should record, and who can see it, under the DfE governance guides.
Work conversations on personal phones
- Guide · Schools
Staff WhatsApp groups in schools: the rules and what a policy should say
Whether a school can require staff to join, when messages become a safeguarding or data protection problem, whether they can be used in disciplinary proceedings, and what no policy can fix.
- Guide · Schools
WhatsApp in schools: parents, staff and the rules that apply
Parent class groups and the school's position, whether to use it with parents at all, what the 24-hour rule actually means, and age limits.
- Guide · Data protection
Is WhatsApp GDPR compliant for work?
The three different things called WhatsApp, the five duties that are hard to meet whichever you mean, whether an employer can require its use, and what metadata Meta receives.
- Guide · Data protection
Subject access requests and WhatsApp messages
What an employer must disclose, what may be withheld or redacted, how tribunals treat them, and what to do when the messages cannot be produced at all.
- Guide · Work messaging
Work messages on personal phones: what the organisation is responsible for, what it can and cannot see, and what the policy has to say
Work messages on staff’s own phones in a school, charity or care service: why the organisation is the controller of what its staff hold there, what the ICO says about personal devices and subject access requests, the limits on looking at a worker’s own phone, what the Cabinet Office’s rules for WhatsApp and private email say a workplace policy should copy, and the record that never reaches the organisation.
- Guide · Work messaging
WhatsApp messages as evidence: tribunals, inspections and regulators, and the organisation that cannot produce them
WhatsApp and text messages as evidence for an organisation in the UK: how a message becomes a document in an employment tribunal, an inspection or a regulator’s inquiry, what the Civil Evidence Act says about copies and business records, the duty to disclose messages that harm your case, screenshots against exports and what authenticity turns on, subject access requests, and the position of the organisation that cannot produce the messages at all.
- Guide · Work messaging
Personal mobile phone policy for staff: what it must cover in a school, a charity or a care service
A personal mobile phone policy for staff in a school, charity or care service: the rules that make one necessary (KCSIE’s staff behaviour policy, the ICO’s guidance on personal devices and on checking workers’ communications, CQC’s records duty), the difference between a pupils’ phone policy and a staff one, the eight things the policy has to cover, what it cannot lawfully do, and the record the policy has to create.
- Guide · Work messaging
Staff messaging policy: what it must say about channels, records, hours and personal phones
A staff messaging policy for a school, charity or care service: the channels that are permitted for which work and the ones that are not, the record every message about a person or a decision has to reach, the Cabinet Office’s rules for WhatsApp, private email and SMS as the published model, hours and expectations, what the organisation may and may not look at under the ICO’s guidance, and the paragraph most policies leave out.
- Guide · Data protection
WhatsApp retention policy: what you can keep and what to write
A retention policy for work messages on WhatsApp: what the app keeps, disappearing messages, backups, leavers' phones, holds, and the rows a UK retention schedule needs.
- Guide · Work messaging
WhatsApp messages in a disciplinary hearing: using them fairly
Using WhatsApp messages in an internal disciplinary under the Acas Code: how they reach the employer, Article 8 and privacy, authenticity, and the employee's own copies.
- Guide · Work messaging
Teams chat retention policy: what Microsoft 365 keeps and deletes
How Microsoft Purview retention policies work for Teams chats and channel messages, what they include and exclude, how deletion really runs, and who is outside them.
- Guide · Schools
Parent communication policy for schools: channels and reply times
What a school parent communication policy should say: channels, response times, who to contact, out-of-hours expectations and staff personal numbers.
- Guide · Governance
Acceptable use policy for staff: schools, charities and care
A staff acceptable use policy for IT, devices and messaging in schools, charities and care: what KCSIE 2026 requires, what to cover, personal devices, and enforcement.
- Guide · Work messaging
WhatsApp group admin responsibilities when the group is for work
What a WhatsApp group admin can and cannot do, and what the admin of a staff, volunteer or parent group answers for: data protection, safeguarding, records.
- Guide · Work messaging
Right to disconnect policy: the UK legal position and what to write
The UK has no statutory right to disconnect. What the law does require for messages after work hours, and how to write a voluntary out-of-hours policy.
- Guide · Data protection
WhatsApp Advanced Chat Privacy: what it blocks in a work group
What WhatsApp’s Advanced Chat Privacy and its replacement, Restricted chat, block and allow, and what that means for a work group’s requests and evidence.
- Guide · Data protection
Bring your own device policy: security and UK GDPR for work data
A BYOD policy for staff using their own phones, tablets and laptops for work data: the ICO’s view, NCSC controls, Cyber Essentials scope, privacy and leavers.
Safeguarding and raising concerns
- Guide · Schools
Keeping children safe in education: the records it asks for
KCSIE 2026 in outline - the five parts, what changed from 2025, and the records the statutory guidance expects schools and colleges to keep.
- Guide · Safeguarding
Safeguarding training records: what schools, charities and care providers must keep, and what an inspector asks to see
Safeguarding training records for schools, charities and adult social care in England: who has to be trained and how often under KCSIE 2026, the Charity Commission’s guidance and CQC Regulation 18, what a training record has to show, what Ofsted and CQC actually ask for, how long to keep it, and the update that is delivered as a message and never reaches the file.
- Guide · Schools
Ofsted safeguarding evidence: what inspectors ask for, when, and where the record has to be
Ofsted safeguarding evidence under the framework in force from September 2026: the ‘met’ and ‘not met’ standard, the notification call, the documents a school must have ready by 8am on day one, what the lead inspector does with the single central record and the designated safeguarding lead’s casework, what “evidence” means beyond the documents, and the record that shows a decision was taken.
- Guide · Governance
Whistleblowing policy: what it must include
Which disclosures the Public Interest Disclosure Act protects, who is covered, what detriment means, and the confidentiality you cannot honestly promise.
- Guide · Safeguarding
Making a MASH referral: what to record before, during and after
A concern followed from the first note to the outcome: thresholds, consent and the new information sharing duty, the one-working-day and 45-day timescales, and the record at each stage.
- Guide · Safeguarding
Channel panel: what happens after a Prevent referral
Notice, Check, Share, the police gateway assessment, the monthly local authority panel, consent, closure and the six- and twelve-month reviews, and the record the referrer should hold at each stage.
- Guide · Schools
Information sharing agreements for schools: what to put in one, and what to record
The section 16LA duty in force from 30 September 2026, the DfE’s two template agreements and the ICO’s checklist, the routes information takes, and the record a school keeps of every decision to share or not share.
- Guide · Schools
DSL handover: live cases, records and cover under KCSIE 2026
How to hand over the designated safeguarding lead role under KCSIE 2026: who can take it, what must transfer, live cases, records and cover for absence.
- Guide · Schools
Child protection file transfer: what KCSIE 2026 requires
How to transfer a child protection file under KCSIE 2026: the five-day timescale, secure transit, the summary, confirming receipt and what the old school keeps.
- Guide · Schools
Allegations against staff: the record KCSIE 2026 requires
What a school must record when an allegation is made against a member of staff under KCSIE Part four: the LADO route, decisions, outcomes, retention and references.
- Guide · Safeguarding
Safeguarding concern form: what to record and where it goes next
What a safeguarding concern form should record for a child or an adult at risk, how to write it, what the council's adult form asks, and where it goes next.
- Guide · Safeguarding
Information sharing between agencies: the duty, tests and record
How safeguarding information is shared between agencies under the section 16LA duty from 30 September 2026 and Working Together 2026, and what to record.
- Guide · Safeguarding
Prevent duty training records: who to train and what to keep
The Prevent duty for schools, colleges and childcare in England and Wales: who needs Prevent training, how often, and the training and compliance records to keep.
- Guide · Schools
Online safety policy for a school: what KCSIE 2026 requires
What a school's online safety policy must cover under KCSIE 2026: the 4Cs, roles, filtering and monitoring, mobile phones, training, incidents and the annual review.
- Guide · Schools
Social media policy for schools: accounts, staff, pupils, parents
What a school social media policy must cover under KCSIE 2026: the school's accounts, staff personal use, pupils' online safety and parents posting about the school.
- Guide · Safer recruitment
Safer recruitment records: what to keep, and what the policy must say
What KCSIE 2026 expects schools to record at each stage of safer recruitment, what the policy should cover, where each record lives and how long to keep it.
- Guide · Safer recruitment
Overseas checks under KCSIE 2026: staff with time outside the UK
What KCSIE 2026 requires for staff who have lived or worked outside the UK: further checks, letters of professional standing and the SCR entry.
- Guide · Schools
Staff–pupil communication policy
What a school’s staff–pupil communication policy should cover: approved channels, professional boundaries, reporting breaches and keeping the record.
- Guide · Schools
Low-level concerns: the policy and the record
The KCSIE 2026 definition of a low-level concern, who decides, what to record, retention, pattern reviews and the rules for references.
- Guide · Schools
Staff behaviour policy for a school
What a school staff code of conduct should cover under KCSIE 2026, with reporting routes, induction, review and the records behind the policy.
- Guide · Schools
Section 175 audit
What a section 175 safeguarding audit covers, how local arrangements vary, who contributes, and how schools can evidence and act on their findings.
- Guide · Safeguarding records
Safeguarding chronology
What belongs in a safeguarding chronology, how to record significant events, who maintains it and how it supports assessment and file transfer.
- Guide · Safeguarding records
Contemporaneous notes: what they are and how to write one
What a contemporaneous note is, why courts, tribunals and regulators give it weight, and how to write one: date, time, exact words, facts, no later edits.
- Guide · Safeguarding
Types of abuse in safeguarding: the statutory definitions
The types of abuse as England's statutory guidance defines them for children and adults, the difference between signs and proof, what to record and who to tell.
- Guide · Safeguarding
Safeguarding link governor: the role, the visits and the board report
What a safeguarding link governor does under KCSIE 2026 and the DfE governance guides, how they work with the DSL, and what they report to the board.
- Guide · Schools
Filtering and monitoring in schools: the annual review and check log
The DfE filtering and monitoring standards and KCSIE 2026: who is responsible, what the annual review covers, which checks to log and what to record.
- Guide · Safeguarding
KCSIE Part one: who must read it, Annex A and the staff declaration
Who must read KCSIE 2026 Part one, what its 82 paragraphs cover, who reads Annex A now, and how to keep a staff declaration and record of reading.
Records and data protection
- Guide · Data protection
Data retention policy: UK requirements and how to write one
What UK GDPR storage limitation actually requires, how to build a retention schedule, where the seven-year rule really comes from, and how deletion is proved.
- Guide · Schools
Record keeping in schools: what to keep and how long
The three regimes a school keeps records under, the retention anchors that cover most of the volume, whether to scan or store, and how to dispose of records securely.
- Guide · Data protection
DBS record keeping: what to keep, for how long, and what never to copy
What the DBS code of practice lets you record, the single central record's checklist, the six-month rule for copies and the places a certificate must never appear.
- Guide · Safer recruitment
The single central record: what it must show, who goes on it, and what an inspector checks
What KCSIE 2026 requires on the register: who must be on it and who need not, the seven checks and their dates, agency staff even for one day, trainees, governors, the volunteers brought into regulated activity on 1 September 2026, and the gaps an inspector finds first.
- Guide · Schools
GDPR in schools: what UK data protection law requires
The data protection officer every school must appoint, why consent is usually the wrong lawful basis, biometrics, subject access, edtech suppliers and the 72 hour breach rule.
- Guide · Data protection
School data breach: what counts, the 72-hour ICO test and the log
What counts as a personal data breach in a school, the 72-hour test for reporting to the ICO, what the breach log must show, and when to tell families.
- Guide · Data protection
Privacy notice for schools: what it must say and the DfE models
What a school privacy notice must contain under UK GDPR Articles 13 and 14, how to adapt the DfE model notices, and the notices for pupils, parents and staff.
- Guide · Data protection
Subject access request policy: how to respond, and the exemptions
What a subject access request policy should say, how to respond on time, the exemptions, and the 2025 Act changes to searches and the clock.
- Guide · Data protection
Right to erasure under UK GDPR: when it applies, how to respond
The right to erasure under UK GDPR Article 17: the grounds, the exceptions for legal obligations, safeguarding and care records, and the one-month clock.
- Guide · Data protection
How long to keep employee records in the UK: statutory periods
How long UK employers must keep employee records: PAYE, minimum wage, holiday, right to work, pensions and accidents, with safeguarding periods for schools and care.
- Guide · Work messaging
Message archiving for compliance in schools, charities and care
Why organisations archive work messages – access requests, FOI, safeguarding, disputes – capture after the fact or at source, and Microsoft 365 retention.
- Guide · Data protection
Data breach log: what to record for every breach, reported or not
The breach log UK GDPR Article 33(5) requires for every personal data breach: the ICO’s template fields, near misses, charity and care reporting, and retention.
- Guide · Data protection
Record of processing activities: what Article 30 requires you to keep
What a record of processing activities must contain under Article 30 UK GDPR, who must keep one, the fewer-than-250-employees exception and how to build it.
- Guide · Data protection
Data protection officer for schools: the appointment and the role
Who the data controller in a school is, why every maintained school and academy must appoint a DPO, who can do the role and how to record it.
- Guide · Data protection
DPIA for schools: when one is required, and what the template holds
When a school must carry out a data protection impact assessment under Article 35 UK GDPR, what the template must contain, and how to sign off and review it.
- Guide · Schools
School exclusion records: the decision, notice and review file
The records the DfE’s July 2026 exclusion guidance requires for each suspension and permanent exclusion: decision, notices, governing board review and IRP.
- Guide · Schools
School accident book: what to record, RIDDOR and how long to keep it
What a school accident book must record for staff, pupils and visitors, which injuries are RIDDOR-reportable, and how long to keep entries under UK GDPR.
- Guide · Schools
School business continuity plan: contents, tests and decision log
What a school business continuity plan should cover under DfE emergency planning, security and digital standards, how to test it, and the records to keep.
- Guide · Data protection
Data protection training for staff: what to cover and what to record
Data protection training for staff in schools, charities and care: what UK GDPR and the ICO expect, who needs it, how often, and the training record to keep.
Choosing a tool
- Guide · Choosing
Messaging app with an audit trail: what to look for
What an audit trail means in messaging, why end-to-end encrypted consumer apps cannot provide one, the questions to ask a supplier, and where the record should live.
- Guide · Choosing
Choosing a work messaging app
What Slack, Teams and Google Chat actually differ on, what happens when the people you need have no work account, and what a free plan does to your message history.
- Guide · Choosing
A GDPR compliant messaging app: what "compliant" has to mean for a UK organisation
No app is compliant on its own: the Article 28 contract, encryption and what it does not do, restricted transfers, the Article 30 record, subject access, retention and the 72 hour breach clock, and the questions to put to any vendor.
- Guide · Work messaging
Encrypted messaging for business in the UK: what it leaves open
What end-to-end encryption protects, what it leaves open, what the NCSC asks of a work messaging app, and the trade-off with keeping and producing a record.
- Guide · Schools
Secure messaging app for schools: what "secure" has to mean
A buyer's guide for schools: what a secure messaging app must do on identity, the record, safeguarding, retention and parents, and the honest alternatives.
Guides for other organisations
Why we write these
We sell a channel your organisation owns, on the record from the first message, filing into your own Microsoft 365. That is a narrow product, and it only makes sense against a duty you already carry. So we write the duties up honestly, cite the regulator rather than ourselves, and say plainly where our product is not the answer.
Every guide is a summary and none of them is legal advice. Where a decision turns on the detail, take proper advice.
How it works · Why us · Pricing · FAQ · Open a channel yourself