Child protection records policy

Code Hamsters (Simple Platform Work Limited)
Version 1.0, approved 13 October 2026 by Mathew Long, Designated Safeguarding Lead (DSL). Next review: October 2027, or sooner after any incident or change in the law or guidance.

1. Why we keep records

Good records protect children. They let us see patterns over time, give children’s social care and the police accurate information, and show what we did and why. This policy covers records of concerns about a child’s welfare and records of concerns or allegations about adults. Our privacy policy explains how we handle personal information more generally.

Three rules apply to every child protection record:

• Access: only the Designated Safeguarding Lead (DSL) can open it.
• Storage: it is kept securely, and for no longer than it is needed.
• Sharing: it is shared only with consent, unless a child is at risk of harm or the law requires us to share it.

2. What we record

• every concern about a child, however small, and every disclosure
• who raised it, when, and exactly what was seen or said, in the child’s own words where possible
• the Designated Safeguarding Lead’s (DSL’s) decision, the reasons for it, and who was consulted
• referrals to children’s social care, the police or the LADO, with dates, times and names
• what parents or carers were told, or the reason they were not told
• the outcome, and any follow-up
• concerns and allegations about adults, including low-level concerns, and how they were resolved

3. How we write them

• On the same day, by the person who saw or heard it, using the record in how we handle disclosures from children.
• Facts first. Opinions are kept separate and labelled as opinion.
• Dated, timed and signed with the writer’s full name and role.
• Never altered afterwards. A correction or addition is a new, dated entry.
• Original handwritten notes are kept, even after they have been typed up.

4. How we store them

• Each child has their own child protection file, started with the first concern. It is kept separately from registers, registration forms and all other records.
• Electronic files are kept in a restricted folder in our secure business storage, protected by a strong password and two-step sign-in. They are never kept on a personal device or account, a USB stick, or a shared computer.
• Paper records are handed to the DSL on the day they are written, kept in a locked container that only the DSL can open, and never left at a venue or in a vehicle.
• Records about adults are stored separately from records about children, with the same protection.
• A front sheet in each file lists what it contains and logs who has seen it, when and why.

5. Who can see them

• Only the DSL has access to child protection records. When a Deputy DSL is appointed and trained, they will have access too, and will be named in our safeguarding and child protection policy.
• Tutors do not have access. A tutor who writes a record hands it to the DSL and keeps no copy. The DSL tells a tutor only what they need to know to keep a child safe.
• Nobody else at Code Hamsters, and nobody at a venue, has access.

6. Sharing records

• We only share information from a child protection record with consent: the consent of the child’s parent or carer, and of the child where they are old enough to understand. The DSL explains what will be shared, with whom and why, and records the consent.
• The one exception is where a child is at risk. If asking for consent would put a child at risk of harm, would delay help that a child needs, or would get in the way of a police investigation, or if consent is refused and the child is still at risk, the DSL shares what is needed with children’s social care, the police or the LADO without it. The law allows this, and safeguarding guidance requires it. We also share without consent when a court or the law orders us to.
• The DSL, and nobody else, decides whether information is shared. Before sharing, the DSL confirms who needs it, exactly what they need and what they will use it for, and that it can be sent securely.
• We share only what is necessary, with a named person, and by a secure method.
• The DSL records what was shared, with whom, when and why, and whether consent was given.
• We do not send child protection information by text or messaging apps.
• If a child moves to another club or provider and there is a child protection file, the DSL takes advice from children’s social care on whether and how it should be passed on.

7. How long we keep them

We do not keep a record for longer than it is needed. For child protection records, how long that is comes from safeguarding guidance, because a child may need the record, or ask to see it, many years later. When the period below ends, the record is destroyed.

We keep a record for longer if a court, a police investigation or a public inquiry requires it. If Code Hamsters stops trading, the records will still be kept securely for these periods.

8. Checking and destroying records

• Once a year the DSL checks every record we hold: that it is accurate, that it is still needed, and whether it is due to be destroyed.
• Paper is shredded with a cross-cut shredder and never put in ordinary waste. Electronic files are permanently deleted, including from backups, and any storage device we stop using is wiped or destroyed.
• We keep a destruction log: a brief description of what was destroyed, how many files, when, and who authorised it. The log does not contain the details of any case.

9. Your rights

• Parents, carers and children can ask for a copy of the information we hold about them. Asking is a child’s right as well as a parent’s, and there is no charge.
• We may need to check who you are first. We reply within one calendar month.
• We remove information about other people. We may withhold information if releasing it would cause serious harm to a child, would not be in a child’s best interests, or could get in the way of an investigation. If we refuse, we explain why and how to complain to the Information Commissioner’s Office.
• You can ask us to correct a record you believe is wrong. We may need to keep a child protection record even if we are asked to delete it.

To make a request, see our privacy policy.

10. If something goes wrong

A data breach is when a record is lost, stolen, destroyed or changed without permission, or seen by someone who should not have seen it, whether deliberately or by accident. Anyone who thinks this has happened tells the DSL immediately. The DSL then:

1. recovers the information if that is possible, for example by recalling an email
2. works out what information is involved, who it is about, and how seriously they could be harmed
3. reports it to the Information Commissioner’s Office within 72 hours of finding out, where there is a risk to the people involved
4. tells the people affected, so they can protect themselves, where there is a risk to them
5. records every breach and near miss, however small, with what happened, why, and what we have changed to stop it happening again

11. The law and guidance we follow

• the UK General Data Protection Regulation and the Data Protection Act 2018
• Data protection in schools (Department for Education). We are not a school, but we follow it as good practice for records about children, including its retention periods.
• Working Together to Safeguard Children (HM Government)
• Information sharing: advice for practitioners providing safeguarding services (HM Government)
• guidance from the Information Commissioner’s Office