Website Security for UK Nurseries and Early Years Providers

Nurseries and the Data They Hold

Nurseries and early years providers collect some of the most sensitive personal data of any small business: information about young children, their families, their health, their development, and their daily routines. The data protection obligations that come with this are significant — and many nursery owners and managers are not fully aware of what is required of them technically.

Under UK GDPR, nurseries are data controllers. They process personal data of children — who are afforded extra protection under data protection law — as well as personal data of parents and guardians. When that data includes health information, special dietary needs, medical conditions, or SEND (Special Educational Needs and Disabilities) records, it is special category data requiring the highest level of protection.

The ICO has specifically stated that organisations processing children's data must take into account the vulnerability of children and apply appropriate measures. A nursery with a poorly secured website or parent portal is not just exposed to reputational risk — it is potentially failing its statutory obligations.

What Nursery Websites and Portals Handle

**Online registration and enquiry forms** — Parent name, address, contact details, child name, date of birth, and often initial information about the child's needs, allergies, or existing SEND diagnoses. This information is collected before a formal relationship has been established and is particularly sensitive.

**Parent portals and communication platforms** — Many nurseries use platforms like Tapestry, Famly, or ParentZone to share daily observations, photos, development records, and communications with parents. These platforms hold a rich record of each child's early development, including photographs taken throughout the day.

**Health and medical records** — Allergy information, medication requirements, immunisation status, medical conditions, and emergency medical plans. This is special category health data for a child — the most sensitive category of data under UK GDPR.

**Safeguarding records** — Nurseries maintain safeguarding documentation. The security of systems holding these records is critical.

**Settling-in and collection authorisations** — Information about who is authorised to collect a child, including photographs of authorised collectors in some cases.

**Invoicing and payment** — Parent payment records and childcare voucher or Tax-Free Childcare processing details.

Common Security Issues for Nursery Websites

Outdated website platforms

A nursery website built on WordPress three years ago and left without maintenance is running known vulnerabilities. A registration form plugin that has not been updated may have a vulnerability allowing attackers to access submitted registration data — including child names, dates of birth, and health information — without authentication.

Insecure registration forms

Online registration forms for nursery places often collect the most sensitive data the nursery holds about a child. If that form is served over HTTP rather than HTTPS, the data is transmitted without encryption. If form responses are stored in a third-party form tool with default sharing settings — a Google Form whose responses sheet is accessible to anyone with the link — they are effectively public.

Parent portal third-party platforms

Platforms like Tapestry and Famly are reputable and handle their own security, but the nursery's configuration of those platforms matters. Weak passwords on nursery staff accounts, not enabling two-factor authentication, or not revoking access for staff who have left the setting are configuration failures that sit with the nursery, not the platform.

Email security

Nurseries communicate sensitive information about children by email — observation summaries, settling-in notes, safeguarding concerns referred to external agencies. Without [DMARC at enforcement policy](/blog/http-security-headers-explained-uk), an attacker can send emails that appear to come from the nursery's domain. Without two-factor authentication on the email account, a compromised credential gives an attacker access to every email ever exchanged with parents and agencies.

No privacy notice or consent records

UK GDPR requires a lawful basis for processing personal data. For nurseries, processing children's data requires either a legitimate interest basis or, for special category data, explicit consent. The website must carry an accurate privacy notice explaining what data is collected and how it is used. Missing or outdated privacy notices are a compliance gap that the ICO actively investigates.

What Good Security Looks Like for a Nursery

**HTTPS everywhere** — Every page of the nursery website, including every registration and contact form, must be served over HTTPS with a valid SSL certificate.

**Secure form data handling** — Registration form data should be stored in a password-protected system with access limited to staff who need it. Email delivery of form responses to a shared inbox is not sufficient for sensitive registrations.

**Two-factor authentication on all accounts** — Staff accounts on parent portal platforms, the nursery website admin, and the nursery's email account should all require two-factor authentication.

**Regular access reviews** — When a staff member leaves the nursery, their access to all systems — parent portal, website admin, email aliases — should be revoked on the same day.

**Email authentication** — SPF, DKIM, and [DMARC](/blog/http-security-headers-explained-uk) at enforcement policy for the nursery's email domain.

What Yrzo AI Covers

The [Essential scan (£149)](/checkout/starter) covers the nursery website security baseline:

- HTTPS configuration across all pages and forms - Security headers - Email authentication — SPF, DKIM, DMARC - WordPress and registration plugin vulnerabilities - Third-party script inventory from embedded parent communication widgets - Exposed admin panels

The report gives specific, plain-language remediation steps that a nursery manager or their web developer can act on directly. [Start with a free scan](/free).

Related reading: [Website Security for Childcare Providers UK](/blog/website-security-childcare-providers-uk) · [GDPR Website Security Requirements UK](/blog/gdpr-website-security-requirements-uk) · [Website Security for Private Schools UK](/blog/website-security-private-schools-uk)