Data Protection Law Has Changed: What Nursery Leaders Need to Know

Here at Redwing we concern ourselves with employment law but we often see an overlap between the work we do and Data Protection law.

On 19 June 2025, the Data (Use and Access) Act 2025 received Royal Assent. Rather than replacing UK GDPR or the Data Protection Act 2018, the new Act makes a series of changes to the existing rules. Those changes have been introduced in stages, with the data protection provisions now in force.

So, what does this actually mean for Nursery Leaders?

One particularly useful change concerns Subject Access Requests (SARs). Employees and former employees can request copies of personal information held about them, and occasionally those requests can be extremely wide-ranging especially when AI has been used to help them to word their request or they have asked a solicitor to act of their behalf.

The law now makes clear that organisations are required to undertake reasonable and proportionate searches when responding to a SAR.

That doesn’t mean you can ignore a difficult or inconvenient request. However, it does provide welcome clarity that an employer isn’t necessarily expected to search endlessly through every conceivable location simply because an employee has submitted an exceptionally broad request.

Another important change concerns data protection complaints.

Organisations must facilitate individuals making complaints about how their personal information has been handled. There are also requirements around acknowledging complaints and responding to them. This means it is worth reviewing your Data Protection Policy and Privacy Notices to make sure employees and applicants understand how they can raise a concern.

There are also changes concerning legitimate interests and information sharing which may be particularly interesting to Early Years providers.

The Act introduces certain recognised legitimate interests, including specified public-interest purposes. This provides greater clarity in some circumstances involving matters such as safeguarding, crime prevention and disclosures to public bodies.

But there is an important warning here.

Safeguarding does not simply “trump GDPR”.

Nurseries still need to consider why information is being shared, who it is being shared with, how much information is necessary and whether there is an appropriate lawful basis for doing so.

There have also been changes affecting automated decision-making, international data transfers and cookies, alongside significantly stronger potential penalties for breaches of the Privacy and Electronic Communications Regulations.

The practical message for Nursery Leaders is simple: don’t assume that because you updated your GDPR paperwork several years ago, it is still up to date.

Now is a sensible time to review your Data Protection Policy, employee and applicant Privacy Notices, SAR procedure and data protection complaints process.

Data protection hasn’t disappeared. It has evolved, and your nursery’s procedures need to evolve with it.

In England, with the new requirement for employees to make disclosures in a much more wide ranging way from 1st September, more and more personal data, known under GDPR as criminal offence data will be held by Nursery Leaders. This could lead to more Subject Access Requests.

If you need assistance managing any aspect of HR in your Day Nursery, please call the team on 01527 909436.