Website Security for Childminders and Nurseries in the UK

Why Childcare Data Requires Particular Care

Childminders and nurseries occupy a position of high trust with the families they serve. The data they hold reflects that position: children's full names, dates of birth, home addresses, emergency contact details, medical conditions and allergies, dietary requirements, special educational needs information, and in many cases photographs. This is a combination of children's personal data and — where health and medical information is involved — special category data under UK GDPR.

The obligations on childcare providers processing this data are significant. Registered childminders and nurseries are data controllers. They must have a lawful basis for each category of data they process, provide a privacy notice to parents, implement appropriate technical security measures, and notify the ICO of breaches affecting 250 or more individuals or posing a high risk to individuals, within 72 hours.

Ofsted's statutory framework for the Early Years Foundation Stage (EYFS) also references data protection compliance as part of the management and leadership requirements for registered providers.

The Digital Attack Surface for Childminders and Nurseries

**Enquiry and registration forms** — Most childcare providers now take initial enquiries and registrations online. These forms typically capture children's names, dates of birth, and parent contact details. They are often built using simple contact form plugins or embedded Google Forms, with varying levels of security.

**Parent communication portals** — Platforms like Famly, Tapestry, and Blossom are used by many nurseries to share daily updates, photographs, and development reports with parents. Where a nursery builds its own communication functionality into its website, the security of those features matters significantly given the sensitivity of the content.

**Attendance and payment systems** — Online payment systems for nursery fees, childminding invoices, and registration deposits handle financial data in addition to personal data.

**Photograph sharing** — Many nurseries share photographs of children with parents through password-protected online galleries or parent apps. The security of photograph storage and access controls deserves careful attention.

**Staff login areas** — Where practitioners access children's records through a website-based system, authentication controls and access permissions need to be properly configured.

Specific Risks

**Exposed children's photographs** — Images of children stored in web-accessible directories without proper access controls can be discovered and accessed by anyone with the URL. This is particularly serious for children whose parents have restrictions on their photographs being shared — for example, children subject to court orders. Directory listing should be disabled on web servers hosting childcare imagery.

**Weak authentication on staff portals** — Login pages without account lockout or multi-factor authentication are vulnerable to credential stuffing and brute force attacks. A compromised staff account gives access to children's records including medical information and home addresses.

**Insecure data transmission on registration forms** — Enquiry and registration forms that submit data over an unencrypted connection (HTTP rather than HTTPS) expose sensitive data to interception. All pages of a childcare website, and particularly those containing forms, must be served over HTTPS.

**Third-party plugins with known vulnerabilities** — Childcare websites built on WordPress often use form plugins, gallery plugins, and payment plugins. Plugins that are not kept updated can contain known vulnerabilities that are actively exploited by automated scanning tools.

**Email security** — Childcare providers send sensitive communications by email: registration confirmations containing children's details, invoices, and sometimes medical consent forms. Without DMARC, DKIM, and SPF configured correctly, your domain can be spoofed by attackers impersonating your nursery to parents.

UK GDPR Obligations Specific to Children's Data

The ICO's Age Appropriate Design Code (Children's Code) applies primarily to online services likely to be accessed by children. A nursery website is not typically accessed by children directly — but the underlying data protection principles apply with particular force to data about children.

Key points for childcare providers:

**Data minimisation** — Collect only the data you need. If a medical condition is not relevant to the care you provide, do not record it. The less data you hold, the less harm a breach can cause.

**Retention limits** — Children's records should be retained for the period required by regulation and then securely deleted. The EYFS framework specifies certain retention periods for records.

**Subject access requests** — Parents (as legal guardians) can make subject access requests on behalf of their children. Having a clear process for responding is part of compliance.

**Breach notification** — Any breach involving children's data, particularly special category health data or home address information, is likely to be high risk and require ICO notification within 72 hours.

Practical Steps

Run an updated CMS with automatic security updates enabled. Use strong, unique passwords and two-factor authentication on all admin accounts. Ensure all pages serve over HTTPS. Review what personal data is collected through your website and whether each field is necessary. Check that your contact forms store submissions securely or route them directly to email without retaining them in a database accessible through the website.

For nurseries using third-party parent communication platforms, review each platform's data processing agreement and security certifications before sharing children's data through it.

The [GDPR website security requirements](/blog/gdpr-website-security-requirements-uk) guide covers the broader technical obligations under UK GDPR in more detail — useful if you want to understand what "appropriate technical measures" actually means in practice. And [two-factor authentication for website security](/blog/two-factor-authentication-website-security-uk) explains the implementation options available for small businesses and care providers specifically.

An automated security assessment from Yrzo AI checks the technical security of your childcare website across 54 controls, including authentication, data transmission security, server configuration, and HTTP security headers. Plain-language results with specific remediation steps, from yrzoai.dev.