Staff behaviour policy for a school

The rule: what requires the policy and what it must include

The requirement is in Part two of Keeping children safe in education 2026, paragraph 123, which lists what governing bodies and proprietors should ensure all staff receive at induction. One item is “a staff behaviour policy (sometimes called the code of conduct) which should, amongst other things, include low-level concerns, allegations against staff and whistleblowing, plus acceptable use of technologies (including the use of mobile devices), staff/pupil relationships and communications including the use of social media”. Paragraph 124 adds that these policies, “along with Part one of this guidance and information regarding the role and identity of the designated safeguarding lead (and deputies), should be provided to all staff on induction”, and paragraph 125 allows a “proportionate risk-based approach” for temporary staff, volunteers and contractors.

The legal duty that makes the guidance bite is section 175 of the Education Act 2002 for maintained schools and colleges, which requires governing bodies to exercise their functions “with a view to safeguarding and promoting the welfare of children” and to “have regard to any guidance given from time to time by the Secretary of State”; for academies and independent schools the Education (Independent School Standards) Regulations 2014 place the same duty on the proprietor. Paragraph 514 turns the duty into oversight: the governing body or proprietor “should ensure their staff code of conduct, behaviour policies and safeguarding policies and procedures are implemented effectively and ensure that appropriate action is taken in a timely manner”.

For teachers there is a second source. Part Two of the Teachers’ Standards requires “consistently high standards of personal and professional conduct”, including “treating pupils with dignity, building relationships rooted in mutual respect, and at all times observing proper boundaries appropriate to a teacher’s professional position”, and “having regard for the need to safeguard pupils’ well-being, in accordance with statutory provisions”. The Teaching Regulation Agency measures misconduct against those words; a school’s code of conduct is where they are turned into rules staff can follow. The footnote to paragraph 123 adds the criminal law: section 16 of the Sexual Offences Act 2003 makes sexual activity by a person in a position of trust with a child under 18 an offence “even if the relationship is consensual”.

What the policy covers

The five items paragraph 123 names are the minimum. The document most schools build on is the Safer Recruitment Consortium’s Guidance for safer working practice for those working with children and young people in education settings (2022), which says of itself that it forms part of “the school’s child protection policy and staff behaviour policy (sometimes called code of conduct) of which this document will become a part”. Its 28 sections are, in effect, the table of contents of a complete code:

• The reporting culture: responsibilities, making professional judgements, and the rule that “all concerns that do not meet the harm threshold must be recorded and dealt with appropriately as a low level concern”.
• Boundaries: power and positions of trust; infatuations and “crushes”; social contact outside the workplace; sexual conduct; one-to-one situations; gifts, rewards, favouritism and exclusion.
• Conduct: standards of behaviour in and out of work; dress and appearance; confidentiality and data protection.
• Technology: communication with children including the use of technology; photography, video and other images; the use of technology for online and virtual teaching; exposure to inappropriate images.
• Care and contact: physical contact; activities that require it; intimate and personal care; behaviour management; care and control and physical intervention; first aid and medication.
• Off-site and residential: home visits; transporting pupils; educational visits; personal living accommodation on site; overnight supervision and examinations.

To those the school adds its own: the whistleblowing procedure (which in a school is a separate document the code cross-refers to), the allegations procedure under Part four of KCSIE, the acceptable use policy for the school’s systems and devices, the mobile phone rule for staff on the school site, and the social media clause. The policy also has to say who it covers – teaching staff, support staff, the senior leadership team, supply staff, volunteers, contractors, governors and trustees, on and off the school premises and outside working hours – and paragraph 125 permits a proportionate risk-based approach to induction. A short briefing may help, but it must still give the visiting coach the information needed for the role. A primary school with twenty members of staff and a large secondary need the same headings; only the examples differ.

The code sits inside the school’s safeguarding policy set rather than beside it. The child protection policy says what staff do when a child may be at risk of abuse or neglect; the staff behaviour policy says how adults conduct themselves so that the school community – pupils and staff, parents and carers – can trust them; and the two cross-refer, because a breach of the second is often the first sign of the first.

What each section has to say

The value of the safer working practice guidance is that each section states the principle and then, in a right-hand column, what it means staff should and should not do. A code that borrows that structure is one staff can actually apply. The sections that carry most weight:

1. Positions of trust. “All those working with children in a school or education setting are in a position of trust in relation to all pupils on the roll.” The relationship “cannot be one between equals”, and staff “should always maintain appropriate professional boundaries, avoid behaviour which could be misinterpreted by others and report any such incident to a senior manager”. The guidance adds a line the code should keep: “This is as relevant in the online world as it is in the classroom.”
2. Standards of behaviour. Staff “should adopt high standards of personal conduct in order to maintain confidence and respect of the general public”, and should be aware that behaviour “either in or out of the workplace” could compromise their position, bring the employer into disrepute, or result in “prohibition from teaching by the Teaching Regulation Agency”. This is where conduct outside work, which KCSIE’s low-level concern definition includes, belongs.
3. Confidentiality. Special category data about pupils and families “must be kept confidential at all times and only shared when legally permissible”, and “records should only be shared with those who have a legitimate professional need to see them”. The code should name the DSL and the information-sharing route, and should say plainly that pupils are never discussed in staff social media groups.
4. Social contact outside the workplace. Genuine friendships with parents exist, but “professionals who sexually harm children often seek to establish relationships and contact outside of the workplace with both the child and their parents”. Where social contact is sought or occurs, the member of staff should “exercise her/his professional judgement in that moment and then inform the Head/senior manager as soon as possible”.
5. Communication with children. Within “explicit professional boundaries”, on the school’s equipment, never with personal contact details, and with any approach from a pupil reported to a manager. The full rules are in the staff–pupil communication guide linked below.
6. Images and devices. Photographs of pupils only on school devices and under the school’s image policy; the setting should “wherever possible, provide school devices such as cameras and mobile phones rather than expecting staff to use their own”.
7. One-to-one situations, home visits and transport. Each has the same shape: avoid where possible, tell someone in advance, record afterwards, and never be alone with a pupil in a place or at a time the policy has not anticipated.

Two drafting rules follow. Write the code so that every rule names the person to tell and the record to make – the guidance’s own phrasing is “always record discussions and actions taken with their justifications”. And keep the code and the pupil behaviour policy separate documents. They share a name and nothing else: the pupil behaviour policy is the one the Education and Inspections Act 2006 requires, dealing with the standards of behaviour expected of pupils, positive behaviour, sanctions and removal from the classroom, reasonable adjustments for pupils with special educational needs, behaviour support plans, early intervention and the underlying factors leading to misbehaviour, and its approval follows the applicable school governance arrangements; the staff behaviour policy addresses the conduct of adults, with governing-body or proprietor oversight and approval under the school or trust’s scheme of delegation. A search for “behaviour policy” returns both, which is how a school ends up handing new staff the wrong one.

Low-level concerns, allegations and whistleblowing: the three routes the code must open

Paragraph 123 names three things the policy must include that are procedures rather than standards, and the code has to tell staff how each works.

Low-level concerns (KCSIE Part four, section two). A low-level concern is “any concern – no matter how small, and even if no more than causing a sense of unease or a ‘nagging doubt’ – that an adult working in or on behalf of the school or college may have acted in a way that is inconsistent with the staff code of conduct, including inappropriate conduct outside of work, and does not meet the harm threshold” (paragraph 509). Paragraph 513 says the policy for them should sit “within their staff code of conduct and safeguarding and child protection policies”; paragraph 527 says “a good low-level concerns policy will simply be a reflection and extension of the school or college’s wider staff behaviour policy/code of conduct”. The code therefore names who receives a concern (the DSL or the headteacher), states that the headteacher is “the ultimate decision maker”, and tells staff that all concerns “should be recorded in writing” and reviewed for patterns.

Allegations that may meet the harm threshold (Part four, section one, paragraph 437): behaviour that “has harmed a child, or may have harmed a child”, may be “a criminal offence against or related to a child”, “indicates he or she may pose a risk of harm to children” or “indicates they may not be suitable to work with children”. These go to the local authority designated officer, and the code says so, names the case manager (the headteacher, or the chair of governors where the head is the subject) and points to the allegations procedure.

Whistleblowing. The code cross-refers to the school’s whistleblowing procedure and states what KCSIE says in Part one: that staff who have concerns about poor or unsafe practice and potential failures in the school’s safeguarding regime should raise them, and that where they feel unable to do so internally the NSPCC Whistleblowing Advice Line (0800 028 0285) “is available as an alternative route for staff who do not feel able to raise concerns regarding child protection failures internally”. The safer working practice guidance frames the underlying expectation as self-reporting: staff “should work, and be seen to work, in an open and transparent way including self-reporting if their conduct or behaviour falls short of these guiding principles”.

Giving it, signing it, reviewing it and enforcing it

A policy nobody has read is not implemented “effectively” in the sense of paragraph 514. The steps that make it real:

• Induction. The policy is given to every member of staff at induction with Part one of KCSIE, the child protection policy and the identity of the DSL (paragraph 124), and a signed or electronically recorded acknowledgement is kept on the personnel file. For supply staff, volunteers and contractors, the proportionate version (paragraph 125), recorded the same way.
• Training. Include the code in regular safeguarding training and updates, which KCSIE requires at least annually; the sections on positions of trust, low-level concerns and communication are the ones to rehearse with scenarios.
• Review. Set a regular review date and check the code whenever KCSIE or local arrangements change. Review the clauses on communications, social media and mobile devices. Approval follows the school or trust’s scheme of delegation.
• Consistency. The code, the child protection policy, the acceptable use policy, the mobile phone policy and the whistleblowing procedure have to agree with each other; a code that permits what the acceptable use policy forbids will be applied by whichever document the member of staff read last.
• Enforcement. A breach is a low-level concern or an allegation depending on the harm threshold, and the code says which route applies; a disciplinary process, where one follows, is under the school’s disciplinary procedure and the ACAS Code, with the record from the low-level concerns file as its evidence.
• References. Paragraph 524: only substantiated concerns that met the harm threshold are disclosed; a low-level concern relating exclusively to safeguarding “should not be referred to in a reference”, though misconduct or poor performance may be relevant to a fair and accurate reference.

Inspectors read the code to see whether the school has thought about its own adults, and the low-level concerns file to see whether the code is used. A code with no concerns recorded against it in a year is not evidence of a school without concerns.

The conduct that now happens in messages

Read the safer working practice sections again with a phone in mind. Social contact outside the workplace is a friend request. Gifts, favouritism and exclusion are who is in the group chat. Confidentiality is what is said about a pupil in the staff WhatsApp at nine at night. Positions of trust are “as relevant in the online world as in the classroom”, in the guidance’s own words. The code of conduct describes behaviour that, for most staff most of the time, now takes place in messages, and a code can only be enforced where the school can see.

The school can manage access to its own systems. Work messages on personal devices can be harder to retrieve, and any retrieval must respect privacy and data protection law. So the conversations the code most needs to reach – the staff group where a pupil is discussed, the message to a colleague that is the first raising of a low-level concern, the reply to a parent from a personal number, the self-referral the code asks for – may be difficult to produce when the LADO, a disciplinary panel or an inspector asks. The policy on one side tells staff to report and record; the channels on the other side are ones nobody in the school runs.

Use a restricted reporting route, with access limited to the people who need the information. A recorded message is not proof that someone has read or acted on a concern: follow the safeguarding procedure, contact the responsible person directly when action is urgent, and use the local authority or emergency route when required. Add the relevant information and decisions promptly to the formal safeguarding record.

The fix is not to police personal phones. It is to give staff a channel the school owns for the conversations the code covers – one that works from a corridor or a kitchen on a personal handset, where everyone in it has been told it is on the record, and where the conversation is the record rather than a summary written later. The question for the governing body is whether the code of conduct names such a channel, or whether it assumes one that does not exist.

Official guidance and your next step

The primary sources are Keeping children safe in education 2026 (Part two, paragraphs 123 to 125 and 514; Part four, sections one and two), the Safer Recruitment Consortium’s Guidance for safer working practice (2022), the Teachers’ Standards (Part Two), section 175 of the Education Act 2002 and the Education (Independent School Standards) Regulations 2014. The NSPCC Whistleblowing Advice Line is the external route KCSIE names in Part one.

This guide is a summary of published guidance for England, not a substitute for it and not legal advice. A code of conduct is incorporated into employment contracts in many schools; take advice on the parts that bind individual staff, and read the college-specific paragraphs if you are a college.

Then do one thing: put paragraph 123 beside the code of conduct and tick off its five items. If “communications including the use of social media” is answered by one line about friend requests, that section needs writing.