Pupil Protect
Sign inBook a demo

Guides › Can parents see safeguarding records?

Can parents see their child's safeguarding records?

Not automatically, and rarely in full. Parents have no automatic right to see a child's safeguarding records: the right of access under data protection law belongs to the child, so a parent can usually make a subject access request for them only if the child isn't mature enough to act for themselves, or has agreed. Even then, the school can withhold information where disclosure would be likely to cause serious harm, would not be in the child's best interests, would identify other people, or would prejudice a police investigation.

Updated . Checked against the official guidance. Sources

Whose right it is

Under Article 15 of the UK GDPR, a person can ask for a copy of the personal data an organisation holds about them. This is a subject access request (SAR). For a pupil’s safeguarding or child protection records, the person the data is about is the child.

The ICO’s guidance, updated on 7 April 2026, says the right to access information about a child “is the child’s right rather than anyone else’s”. Before answering, the school decides whether the child is mature enough to understand their rights. In Scotland a child of 12 or over is presumed to be. That presumption doesn’t apply in England, but the ICO says 12 is still a useful guide.

  • If the child is competent, respond to the child. A parent can act for them if the child authorises it, or if it’s clearly in the child’s best interests.
  • If the child isn’t competent, a person with parental responsibility can usually exercise the right for them, unless that wouldn’t be in the child’s best interests.

A figure of 13 sometimes appears in answers online. That is the age in Article 8 of the UK GDPR at which a child can consent to online services. It isn’t the test for a subject access request.

The ICO also lists things to weigh: any court orders, any duty of confidence owed to the child, the risk of harm, especially where abuse is alleged, the effect on the child of refusing access, and the child’s own views.

A separate right: the educational record

Parents of pupils at maintained schools have a separate right under regulation 5 of the Education (Pupil Information) (England) Regulations 2005 to see or have a copy of their child’s educational record, within 15 school days of a written request. The ICO notes this right doesn’t apply to academies or free schools in England. It also can’t be used to get anything the pupil couldn’t get under the UK GDPR, so the exemptions below still apply (regulation 5(4)).

Some summaries say these regulations exclude child protection files from the educational record. They don’t say that. Regulation 3 excludes only information a teacher keeps solely for their own use, and nothing in the regulations mentions child protection. What protects safeguarding information is regulation 5(4) and the Data Protection Act 2018 exemptions below. KCSIE 2026 says it is good practice to keep concerns and referrals in a separate child protection file for each child (paragraph 74), which makes those decisions easier to manage, but a separate file is not in itself an exemption.

Deadlines

  • A SAR must be answered within one month of receipt. This can be extended by up to two further months if the request is complex.
  • There is no extra time for school holidays. The ICO says a SAR received while the school is closed must still be answered in the normal time.
  • You can’t usually charge a fee, unless the request is manifestly unfounded or excessive.
  • The Data (Use and Access) Act 2025 added Article 15(1A) to the UK GDPR. It says the requester is entitled to what the school can provide based on a reasonable and proportionate search.

The exemptions that matter for child protection records

Safeguarding records are rarely released in full. These are the exemptions schools use most often. Each applies only to the extent needed, so you redact what the exemption covers, not the whole file.

Serious harm (education data)

Most information a school holds about a pupil is part of their educational record, which the Data Protection Act 2018 treats as “education data” (Schedule 3, Part 4). The right of access doesn’t apply to education data to the extent that disclosure “would be likely to cause serious harm to the physical or mental health” of the child or anyone else (paragraphs 17 and 19).

Child abuse data

Schedule 3, Part 5, paragraph 21 covers information about whether a child is or has been the subject of, or may be at risk of, child abuse. Where a request comes from someone with parental responsibility for a child under 18, the right of access doesn’t apply to that information to the extent that disclosing it would not be in the child’s best interests. This exemption applies in England, Wales and Northern Ireland, not in Scotland.

Health information

Information about a child’s physical or mental health is not education data. It has its own serious harm test in Schedule 3, Part 2. A school, which isn’t a health professional, can’t withhold health information on that ground without first getting an opinion from the appropriate health professional that the serious harm test is met (paragraph 5).

Reports from other agencies

Child protection files often hold minutes and reports from children’s social care, the police or health. The ICO says that where another organisation’s information is involved, you can consult it and get its views before you respond, and that this may make the request complex enough to extend the deadline. The decision on what to disclose is still yours, and you must be able to explain any exemption you apply.

Information about other people

Schedule 2, paragraph 16 says you don’t have to disclose information that identifies someone else, including the person who gave you the information, unless they consent or it is reasonable to disclose without consent. In deciding, consider the type of information, any duty of confidentiality, whether you’ve asked for consent and any refusal.

Paragraph 17 says it is reasonable to disclose information that identifies an education worker, such as a teacher, acting in that role. The ICO says it’s normally reasonable to disclose information that identifies a teacher. Other children, family members, neighbours and members of the public are the usual redactions.

Crime

Schedule 2, Part 1, paragraph 2 lets you withhold information to the extent that disclosure would be likely to prejudice the prevention, investigation or detection of crime, or the apprehension or prosecution of offenders. This can apply during a police investigation. The ICO says you can’t use it to withhold whole categories of information.

Telling parents about a concern

A subject access request is about seeing records later. A separate question is whether a school tells parents when a concern is raised. KCSIE 2026 says staff should never promise a child that they won’t tell anyone, and should pass concerns to the DSL (paragraphs 14 and 59). The DSL then considers whether to inform parents to support the child, “where doing so does not place the child at additional risk” (paragraph 60). When a school refers to children’s social care, it will generally inform parents unless there are compelling reasons not to, and that decision should be made with children’s social care’s support (paragraph 589, in the section on child-on-child sexual violence and harassment).

Sharing with other professionals

A parent’s request to see records is a different question from whether the school can share them with children’s social care, the police or a child’s next school. KCSIE 2026 says data protection laws “do not prevent the sharing of information for the purposes of keeping children safe”, and that fears about sharing “must not be allowed to stand in the way” of protecting children (Part two, paragraphs 147 and 148). The same part also reminds schools that pupils’ data must be withheld from a subject access request where the serious harm test is met, for example when a child is in a refuge (paragraph 146). Our guide to information sharing in safeguarding covers when and how to share, and the legal bases for doing it without consent.

How long records are kept

There’s no law that sets one period for every school. Most schools follow the IRMS toolkit: a child protection file is kept until the child’s 25th birthday and then reviewed, by the last school the child attended. Our retention calculator works out the date.

Practical steps

  1. Log the request and the date received. Confirm the requester’s identity and, for a parent, their parental responsibility.
  2. Decide whether the child is competent, and if so, ask the child.
  3. Involve the DSL and your data protection officer. Consider consulting children’s social care or the police where their information or an investigation is involved.
  4. Go through the file line by line, applying each exemption only where it fits, and record why.
  5. Keep a copy of exactly what was sent and what was withheld, and the reasons.

Records you may one day have to disclose are easier to handle if they’re factual, dated and clear about who said what. Our guide on recording a safeguarding concern covers this.

Common questions

Can parents request CPOMS or other safeguarding records?

They can make a subject access request, whichever system the records are kept in. But the right belongs to the child. The ICO says a parent can usually exercise it only if the child isn't competent to act for themselves, or the child has authorised it. Information can then be withheld under the exemptions, for example where disclosure would be likely to cause serious harm.

How long does a school have to answer a subject access request?

One month from receiving it. This can be extended by up to two further months if the request is complex. There's no extra time for school holidays. A parent's separate request to see the educational record at a maintained school must be answered within 15 school days.

At what age can a child make their own subject access request?

There's no fixed age in England. The ICO says to judge whether the child is mature enough to understand their rights. In Scotland a child of 12 or over is presumed to be, and the ICO says 12 is a useful guide elsewhere in the UK too. The age of 13 often quoted online is the UK GDPR age for consenting to online services, not an age for subject access.

Do teachers have to tell your parents about safeguarding?

Not always. KCSIE 2026 says staff should never promise a child they won't tell anyone, but concerns go to the designated safeguarding lead, not automatically to parents. The DSL considers whether to inform parents to support the child, where doing so would not place the child at additional risk. In its section on child-on-child sexual violence and harassment, KCSIE says that when a school refers to children's social care it will generally inform parents, unless there are compelling reasons not to, such as putting the child at additional risk, and that decision should be made with children's social care.

Are safeguarding reports anonymous?

Not usually inside the school. KCSIE expects concerns to be recorded in writing, and staff report to the DSL. Staff who feel unable to raise concerns about safeguarding practice internally can use the NSPCC Whistleblowing Advice Line. If a parent later makes a subject access request, information identifying other people, such as a neighbour or another pupil who raised a concern, can be withheld unless they consent or it's reasonable to disclose, but teachers acting in their work role are normally identifiable.

How long are safeguarding records kept?

No law sets one period for every school. Most schools follow the IRMS toolkit, which says to keep a child protection file until the child's 25th birthday and then review it, and longer in some cases, such as where there is a legal claim or allegations of child sexual abuse. The last school the child attended keeps it.

Do we have to redact staff names from safeguarding records?

Usually not. The Data Protection Act 2018 treats it as reasonable to disclose information identifying an education worker, such as a teacher, in their work role. Other pupils, family members and members of the public are different: you need their consent or must judge it reasonable to disclose.

Sources

  1. Data Protection Act 2018, Schedule 3, Part 4 (education data, serious harm test, paragraphs 17 and 19) and Part 5 (child abuse data, paragraph 21). Last checked .
  2. Data Protection Act 2018, Schedule 2, Part 3, paragraphs 16 and 17 (information about other people). Last checked .
  3. Data Protection Act 2018, Schedule 2, Part 1, paragraph 2 (crime and taxation). Last checked .
  4. UK GDPR, Article 15: Right of access by the data subject. Last checked .
  5. ICO, Right of access: How do we recognise a subject access request? (section on requests about children, updated 7 April 2026). Last checked .
  6. ICO, Right of access: Education information. Last checked .
  7. ICO, Right of access: What exemptions are relevant for SARs?. Last checked .
  8. The Education (Pupil Information) (England) Regulations 2005, regulations 3 and 5. Last checked .
  9. UK GDPR, Article 8: Conditions applicable to child's consent in relation to information society services. Last checked .
  10. Keeping children safe in education 2026, paragraphs 14, 59, 60, 74, 80 to 82 and 589 (DfE, in force from 1 September 2026). Last checked .
  11. Keeping children safe in education 2026, Part two, paragraphs 146 to 148 (information sharing). Last checked .

This guide explains the official guidance in plain words. It isn’t legal advice. Your local safeguarding partnership’s procedures and your own policies also apply. If anything here is wrong or out of date, email support@pupilprotect.co.uk.

Related

All guides