A childcare facility processes personal data of children and their parents every day – from names and national ID numbers, through health data, to photographs. GDPR places specific obligations on directors. Here is what you cannot ignore.

What Data Does a Nursery or Kindergarten Process?

In day-to-day operations, a facility collects and processes data in several categories:

  • Child identification data – name, date of birth, PESEL, address
  • Health data – allergies, chronic conditions, vaccination information (special category data – requires extra protection)
  • Parent / guardian data – name, phone, email, address
  • Financial data – bank account number, payment history
  • Image – photos of children at events, in announcements
  • Staff data – employee personal data, contracts, salaries

What Legal Basis Is Required?

GDPR (Art. 6) requires every data processing activity to have a legal basis. For nurseries the most common are:

  • Contract (Art. 6(1)(b)) – data necessary to conclude and perform the childcare contract
  • Legal obligation (Art. 6(1)(c)) – keeping registers required by the Act on Care for Children Under 3
  • Consent (Art. 6(1)(a)) – publishing children's photos, newsletters, optional additional data
  • Legitimate interest (Art. 6(1)(f)) – e.g. CCTV with proportionality maintained

Health data (e.g. allergies) are special category data (Art. 9 GDPR). Processing them requires explicit parental consent or another ground under Art. 9(2).

Information Notices – What Must They Contain?

At first contact with a parent (e.g. when signing a contract) you must provide an information notice (Art. 13 GDPR). It must include:

  • Identity and contact details of the controller (nursery director/owner)
  • Purpose and legal basis for data processing
  • Recipients of data (e.g. accounting office, software providers)
  • Data retention period
  • Rights of the data subject: access, rectification, erasure, objection
  • Right to lodge a complaint with the supervisory authority (UODO in Poland)

Consent for Photos and Children's Image

Publishing children's photos – in app announcements, on the website, in social media – requires explicit parental consent. Key rules:

  • Consent must be voluntary – refusing consent cannot be a reason to deny the child a place
  • Separate consent can be given for different channels (app, Facebook, website)
  • Consent can be withdrawn at any time
  • A mention in the contract is not enough – consent must be a separate, explicit statement

Parent Communication and GDPR – Watch Out for WhatsApp

Many facilities use private messengers (WhatsApp, Messenger). This is a serious problem:

  • Data flows through Meta servers (USA) – this requires data transfer mechanisms
  • Teachers' private phone numbers end up with parents
  • No control over who has access to the group
  • No message history or audit trail

A safe alternative is a dedicated facility system such as TwójSzkrab, which stores data on EU servers and provides access control.

How Long to Retain Data?

Retention periods depend on the type of data:

  • Child data (during enrolment) – for the duration of the contract + limitation period (3 years)
  • Financial documentation – 5 years from the end of the year the document was issued (tax requirements)
  • Employee data – 10 years after end of employment (ZUS/PIP)
  • CCTV recordings – max. 3 months unless evidence in proceedings

What Are the Penalties for GDPR Violations?

The supervisory authority can impose administrative fines up to €20 million or 4% of total annual turnover (whichever is higher). For small facilities the more realistic risks are:

  • Order to stop processing and delete data
  • Obligation to notify parents of a breach
  • Loss of parent trust and facility reputation

How TwójSzkrab Supports GDPR Compliance

When using TwójSzkrab, children's and parents' data is stored on servers in the European Union. The system provides:

  • Restricted data access through a roles and permissions system
  • Secure communication without transmitting data through private messengers
  • Stored message and announcement history with audit capability

Summary

GDPR in nurseries and kindergartens is not bureaucracy for bureaucracy's sake – it protects children and parents. Key obligations: information notices, image consents, secure communication and defined data retention periods. Investing time once in proper documentation and tools means sleeping soundly afterwards.

Want to implement secure parent communication? Discover TwójSzkrab or write to us.