Statutory policies for schools

What the law requires, and where the DfE list went

There is no single statute that lists a school's policies. The statutory requirements come from many Acts and regulations, and for years the DfE gathered them into one table, Statutory policies for schools and academy trusts (withdrawn), last updated on 15 March 2022. That page now says: "This publication was withdrawn on 7 March 2024", and points to the governance guides instead. A list that still quotes its review cycles and approval levels is working from a withdrawn document.

The current list sits at the end of the Maintained schools: governance guide and the Academy trusts: governance guide, both updated in July 2026. Each describes itself as non-statutory guidance, and each introduces the list as information "on the policies and documents they must have", adding: "This is not intended to be a complete list."

Which policies a school is legally required to hold depends on its type:

• Local-authority-maintained schools are bound directly by statute. Section 29(1) of the Education Act 2002, for example, says the governing body "shall establish procedures for dealing with all complaints relating to the school" and "publicise the procedures so established". Their website duties come from the School Information (England) Regulations 2008, as amended.
• Academies are bound through the Education (Independent School Standards) Regulations 2014, which apply to the proprietor, "which in the case of academies and free schools is the academy trust" (KCSIE's words), and through the funding agreement. The DfE says every academy "must publish specific information on its website to comply with either its: funding agreement, or accountability agreement".

Where the law or statutory guidance says "must", it is a requirement. Where statutory guidance says "should", the school must have regard to it and, in the RSE guidance's words, "will need to have good reasons" to depart from it. Where only non-statutory guidance says it, the governing board decides.

The school policies list, and the law behind each

Grouped by subject, with the source for each and where maintained schools and academies differ.

• Child protection policy. Keeping children safe in education 2026, in force from 1 September 2026, says at paragraph 123 that each school should have "an effective child protection policy" that refers to the local multi-agency safeguarding arrangements, covers child-on-child abuse, online safety and SEND, "is reviewed annually (as a minimum)" and "is available publicly". The duty behind it is section 175 of the Education Act 2002 for maintained schools and paragraph 7 of the Independent School Standards for academies. The governance guides list it as "safeguarding and child protection".
• Staff behaviour policy. The same paragraph asks for "a staff behaviour policy (sometimes called the code of conduct)" covering "low-level concerns, allegations against staff and whistleblowing", acceptable use of technology, and staff/pupil communications including social media. Paragraph 126 adds safer recruitment policies that are "in place, embedded and effective".
• Behaviour policy. In a maintained school the duty is split. Under section 88 of the Education and Inspections Act 2006 the governing body "must make, and from time to time review, a written statement of general principles", after consulting the headteacher, staff, parents and pupils. Under section 89 of the 2006 Act the headteacher determines the measures, including "preventing all forms of bullying among pupils". In an academy, paragraph 9 of the Independent School Standards requires "a written behaviour policy" setting out sanctions and a record of "sanctions imposed upon pupils for serious misbehaviour", and paragraph 10 "an effective anti-bullying strategy". Suspensions and permanent exclusions "must follow" the DfE's statutory guidance, in the maintained guide's words; the trust guide says they "must have regard to" it.
• Attendance policy. The statutory guidance Working together to improve school attendance (July 2026) says "all schools are expected to have a clear, written school attendance policy", naming the Senior Attendance Champion, and that trusts and governing bodies should ensure it is "published and publicised regularly". A trust-wide policy "should be tailored to the needs of each individual school".
• Complaints procedure. Maintained schools: section 29, above. Academies: paragraph 33 of the Independent School Standards, which requires a written procedure with an informal stage, a formal written stage and a panel of "at least three people who were not directly involved", one of them independent.
• Whistleblowing. "Every maintained school should have a whistleblowing procedure", agreed by the governing body. Trusts "must have procedures in place for whistleblowing" and the board must "agree the whistleblowing procedure and publish it on the trust's website".
• Staff discipline, grievance, capability and pay. A maintained governing body "must approve" disciplinary and grievance procedures and capability procedures, and provide a route to appeal a dismissal, and the relevant body "must adopt" a pay policy. In an academy the board is responsible for "the appointment, conduct, suspension and dismissal of staff", and trusts "can set their own pay and conditions of service".
• Charging and remissions. The DfE's Charging for school activities advice says: "No charges can be made unless the governing body of the school or local authority has drawn up a charging policy" and a remissions policy. Academies must comply with the same law through their funding agreement.
• Equality. Under the public sector equality duty, governing bodies and trust boards must publish compliance information every year and agree "one or more equality objectives every 4 years". Schedule 10 to the Equality Act 2010 adds an accessibility plan that "must be in writing", kept "under review during the period to which it relates", and implemented.
• SEN information report. Required of maintained schools and academy schools by section 69 of the Children and Families Act 2014 and Schedule 1 to the SEND Regulations 2014. In a mainstream school the board must also designate a special educational needs coordinator (SENCO), under section 67.
• Medical conditions and allergy safety. Governing bodies "should ensure that all schools develop a policy for supporting pupils with medical conditions" that is "reviewed regularly" and "readily accessible to parents and school staff". The allergy safety policy is new this term: see the card below.
• Relationships and sex education. The RSE and health education statutory guidance, in effect from 1 September 2026, says: "All schools must have an up-to-date written policy for relationships education or, where they teach sex education, for RSE", developed with parents and published on the website.
• Health and safety, first aid and fire. The employer carries the Health and Safety at Work etc. Act 1974 duty: the local authority or the governing body, depending on the category of maintained school, and the trust in academies. Academies must also have "a written health and safety policy" and "a written first aid policy" and comply with the Regulatory Reform (Fire Safety) Order 2005 (Independent School Standards, paragraphs 11 to 13).
• Data protection and information. Under UK GDPR and the Data Protection Act 2018, the maintained guide says schools must "provide a statement or privacy notice" and respond to subject access requests "within one calendar month", which Article 12A of the UK GDPR lets a school extend by up to two further months for complex or numerous requests. The DfE's data protection policies and procedures guidance says "It's a legal requirement that your school has data protection policies and procedures in place", and its guidance on data protection officers that "All maintained schools and academies must have a designated data protection officer." Both schools and trusts need a Freedom of Information publication scheme.
• Admissions, careers and uniform. Foundation and voluntary-aided schools and academy trusts must publish their admission arrangements. Secondary schools, not primary schools, must publish a provider access policy statement under section 42B of the Education Act 1997. From 1 September 2026, uniform policies must comply with the new limit on branded items.

Who approves each policy, and how often to review it

Both governance guides leave approval to the board. The maintained guide says: "It is up to governing bodies to decide whether and how to delegate the creation, maintenance and approval of policy documents in their school or federation, unless otherwise stated in relevant guidance." The withdrawn table made the same point: "Not all policies need to be signed off by the full governing body." But governing bodies "are accountable for these documents and the policies and procedures in them". The exceptions are the ones the law names:

• Behaviour. In a maintained school the governing body writes the statement of principles and the headteacher determines the behaviour policy.
• Staff conduct and capability. The maintained guide says certain functions "cannot be delegated", including those relating to "procedures for the regulation of staff conduct and discipline and dealing with a lack of staff capability".
• Academy trusts. A trust can delegate school-level approval to a local committee or headteacher, but the scheme of delegation "must set out the structure and delegated remit" of members, board and committees, and trustees "cannot give up their legal duties".

The sources give a review frequency for only a few documents:

• Child protection policy: "reviewed annually (as a minimum)".
• Equality: compliance information every year; equality objectives "at least every 4 years".
• SEN information report: "updated annually", with in-year changes "as soon as possible".
• Allergy safety policy: "at least once every year" (section 100A of the Children and Families Act 2014).
• Behaviour principles: "from time to time". The headteacher's measures must be brought to pupils', parents' and staff's attention "at least once in every school year".
• Accessibility plan: under review throughout the period it covers.

For everything else, the school or trust decides. The maintained guide adds a general recommendation: "It is recommended that governing bodies review these policies annually. This is with the exception of the equality objectives policy which can be reviewed every 4 years." The trust guide recommends the same annual cycle. The RSE guidance asks each RSE policy to state "who approves the policy, and how and when it will be reviewed", a line worth adding to every policy.

What schools are required to publish online

The DfE's two lists, What maintained schools must or should publish online and What academies and further education colleges must or should publish online, differ in places that matter:

• Behaviour policy. Maintained: "Schools must publish their behaviour policy." Academies: "should publish their behaviour policy, including their anti-bullying strategy".
• Charging and remissions. Maintained schools must publish both; academies should.
• Complaints. Maintained schools must publish the procedure. An academy's "must be available to parents and carers", and the trust guide recommends publishing it online.
• Whistleblowing. "Academy trusts must publish details of their whistleblowing procedure." The maintained list has no equivalent.
• Equality and SEN. Both must publish PSED information, equality objectives and the SEN information report, which includes the accessibility plan and how complaints about SEN support are handled.
• Child protection, RSE, allergy safety and attendance. Publicly available or published, under the statutory guidance above and, for allergy safety, section 100A of the Children and Families Act 2014.
• Governance. Maintained schools must publish information about the governing body and its committees and should publish governors' business interests, in effect the register of interests. Trusts must publish governance arrangements, the business and financial interests of members, trustees, local governors and accounting officers, their articles and their funding agreement.
• Funding statements. Where the school receives the funding, the pupil premium strategy statement "by 31 December each year" and the PE and sport premium report "by 31 July each year".

Both lists say a paper copy should be provided "free of charge, if a parent or carer requests it". A policy published with last year's review date, or a dead link on the policies page, is visible to every parent and Ofsted inspector who looks.

Why a complete folder is not compliance

A school can hold every policy on the list and still fall short of the duty each one serves. In its safeguarding section, the maintained guide says governing bodies must "ensure that policies, procedures and training in their schools are effective and comply with the law at all times", and the allergy guidance says inspectors "will consider medical conditions and allergy safety policies and how well they are implemented". The test is practice, not paper. Four things make a policy count:

1. It describes this school. The child protection policy must refer to the "locally agreed multi-agency safeguarding arrangements", not a neighbouring area's. A model policy from the local authority or the National Governance Association, both named in the governance guides, is finished only when it names this school's people and routes.
2. Staff know it. KCSIE paragraph 124 says the safeguarding policies and the identity of the designated safeguarding lead "should be provided to all staff on induction".
3. It is reviewed on evidence. A review date is not a review. The allergy guidance puts it well: a review "should take account of any incidents and 'near misses' and should seek to learn lessons from them". The same holds for complaints, sanctions and safeguarding concerns.
4. It fits the structure. In a multi-academy trust, decide which policies are trust-wide and which are school-level, record it in the scheme of delegation, and publish the right version on each school's website.

Keep one register as the checklist: each policy, its source, the approver, the date approved, the next review and whether it must be published. The clerk or governance professional is a natural owner, and the board should see it at least once a year. A policy with no source may not be needed; a source with no policy is a gap.

The policy names a route; the message takes another

Almost every policy on the list describes a route. Report a safeguarding concern to the designated safeguarding lead. Raise a complaint informally first, then in writing. Tell the named person about a whistleblowing concern. Record an allergy near miss so the next review can learn from it. In most schools, the first step on each of those routes is now a message.

A parent complains by text to the class teacher, because that is the number they have. A lunchtime supervisor mentions a near miss with a pupil's allergy in the staff group chat. A teaching assistant raises a worry about a colleague in a direct message to a friend on the leadership team at nine in the evening. Each is the first record of the event the policy governs, and each sits on a personal phone the school does not control. The Independent School Standards ask an academy to keep "a written record" of formal complaints and the action taken; the allergy guidance asks for near misses to inform the review. The informal step that comes first is rarely held anywhere.

ComplyChat provides a channel for those work conversations. A mobile number verified by SMS is the identity on it, so support staff, volunteers and parents with no school account can be in the conversation; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans the lasting record files into the school's or trust's own Microsoft 365 once the tenant is connected, under its own retention rules. It is not a policy library, a safeguarding case-management system or a complaints tracker, and it cannot reach messages sent in personal apps. It gives the first message on each policy's route somewhere the school holds.

A question for governors and trustees at the next board meeting: for the child protection, complaints and whistleblowing policies, where does the first report actually arrive, and does the policy say so?

Official guidance and your next step

Start with the Maintained schools: governance guide or the Academy trusts: governance guide, then the DfE's publishing lists and the statutory guidance linked above. An academy should also read its funding agreement and the Academy Trust Handbook. Quotations are from those pages as published on 26 September 2026. This guide is for state-funded schools in England; independent schools, and schools in Wales, Scotland and Northern Ireland, have their own requirements.

It is a practical starting point, not legal advice, and not a substitute for policies written for your own school or trust.

Then do one thing: open the school website's policies page beside this list. For each policy, check that it is there if it must be, that its review date is within the cycle its source gives, and that it names the law it serves. The first one that fails is the next agenda item.