Safeguarding, data protection and defensible decisions

KCSIE 2026: what schools should review from a data protection perspective

Keeping Children Safe in Education is safeguarding guidance first, but it also shapes how schools collect, record, share, retain and disclose information about children.

The 2026 update is expected to keep pushing safeguarding, digital risk and information governance closer together. Schools do not need to wait for every final wording change before reviewing the basics: where safeguarding information is held, who can access it, how decisions are recorded, and how data protection requests are handled when child protection context is involved.

Why KCSIE 2026 matters for data protection

Safeguarding work depends on information. Schools need to know what has happened, who was involved, what action was taken, what advice was received and why a decision was made.

That means data protection and safeguarding are not separate worlds. They meet in practical areas such as:

• child protection records;
• safeguarding chronologies;
• subject access requests;
• parent requests for information;
• information sharing with agencies;
• retention and transfer of records;
• digital safeguarding systems;
• filtering and monitoring;
• AI-enabled or adaptive education tools.

The risk for schools is not usually that data protection prevents safeguarding. The bigger risk is poor evidence of decision-making: unclear records, inconsistent access, weak supplier assurance or a SAR response that does not properly consider safeguarding context before disclosure.

The practical issue for schools

Schools often have to balance several duties at once:

• protecting children from harm;
• respecting confidentiality;
• responding to parents, pupils and professionals;
• keeping accurate records;
• sharing information where it is necessary and proportionate;
• withholding information where disclosure could create risk;
• demonstrating accountability under UK GDPR.

This is where a clear governance approach matters. Schools need records that show not just what was done, but why it was done.

Areas to review now

1. Safeguarding record structure

Check where safeguarding records are held and how they are separated from general pupil records.

Schools should be able to explain:

• where child protection records are stored;
• who can access them;
• whether access is role-based;
• how concerns, actions and decisions are recorded;
• how records transfer when a child moves school;
• what is retained and for how long.

A safeguarding platform can help, but only if the underlying governance is clear.

2. SAR triage involving safeguarding information

Subject access requests involving safeguarding information should not be treated like routine document disclosure.

Before disclosure, schools should consider:

• whose personal data is included;
• whether third-party information appears;
• whether disclosure could cause harm;
• whether exemptions may apply;
• whether the child’s interests and views need to be considered;
• whether the DSL, DPO or senior leader should be involved.

The key point is that safeguarding context should be identified early, not discovered at the final redaction stage.

3. Parent requests and child voice

Parent requests can be complex where records include the child’s own words, allegations, safeguarding concerns or information about family circumstances.

Schools should review how they handle:

• parental responsibility checks;
• requests from separated parents;
• records containing child voice;
• information about other family members;
• professional opinions and referrals;
• safeguarding concerns that may be sensitive or disputed.

A defensible response should show that the school considered both access rights and potential harm.

4. Information sharing decisions

KCSIE and wider safeguarding guidance support appropriate information sharing where it is necessary to protect children. Data protection law does not stop that, but schools should still record the basis for key decisions.

For higher-risk sharing decisions, record:

• what was shared;
• who it was shared with;
• why sharing was necessary;
• the lawful basis or condition relied on;
• any safeguarding rationale;
• any limitations on onward sharing.

This creates an evidence trail if the decision is challenged later.

5. Digital safeguarding systems and suppliers

Many safeguarding records now sit in digital platforms. Schools should know whether those systems are covered properly in their data protection records.

Review whether you have:

• a current contract or data processing agreement;
• clear controller/processor roles;
• sub-processor information;
• retention and deletion arrangements;
• access control settings;
• audit log availability;
• supplier security information;
• a DPIA or screening decision where needed.

If a platform handles safeguarding data, supplier assurance should be stronger than a generic “GDPR compliant” statement.

6. Filtering, monitoring and digital risk

KCSIE already requires schools to consider appropriate filtering and monitoring. From a data protection perspective, schools should understand what these tools collect and how alerts are handled.

Check:

• what monitoring data is collected;
• who receives alerts;
• whether pupil activity is profiled or risk-scored;
• how false positives are handled;
• how long monitoring logs are retained;
• whether staff know how to escalate concerns;
• whether the system has been assessed through a DPIA or supplier review.

Filtering and monitoring should be safeguarding-led, proportionate and evidenced.

7. AI and adaptive tools

AI-enabled and adaptive tools create extra governance questions, especially where children’s information is involved.

Schools should ask:

• whether AI is used at all;
• what data the tool relies on;
• whether outputs affect pupils;
• whether staff can understand and challenge outputs;
• whether the supplier uses data for training or product improvement;
• whether parents, pupils and staff are told enough;
• whether the tool needs a DPIA.

The issue is not whether AI is automatically banned. The issue is whether the school can explain what the tool does, what safeguards apply and why use is appropriate.

A practical review checklist

Use KCSIE 2026 preparation as a prompt to review the following:

What good evidence looks like

A school does not need unnecessary bureaucracy. It does need evidence that key decisions were considered properly.

Good evidence might include:

• a clear ROPA entry for safeguarding systems;
• a DPIA or screening record for higher-risk tools;
• access control review notes;
• a SAR triage record;
• a redaction decision log;
• a record of information sharing;
• supplier assurance documents;
• a review date and named owner;
• policy wording that matches actual practice.

The aim is simple: if a decision is challenged, the school can show the reasoning.

How Tru Data Protection can help

Tru Data Protection supports schools and trusts with the governance work behind safeguarding and data protection decisions.

That can include:

• reviewing safeguarding-related SARs;
• supporting FOI and information rights requests;
• preparing evidence packs;
• redacting sensitive material;
• reviewing DPIAs and supplier evidence;
• updating ROPA records;
• improving policy wording;
• creating decision records that schools can stand behind.

The focus is practical: clear advice, recorded decisions and proportionate handling of sensitive information.

Key takeaway

KCSIE 2026 should be treated as more than an annual safeguarding update. It is a useful prompt to check whether safeguarding information is governed properly.

Schools should be able to answer:

Can we show how safeguarding information is collected, used, shared, retained, protected and disclosed — and can we explain the decisions behind that?

If the answer is unclear, now is the right time to review the evidence trail.