Safety and Protection for the Little Ones
Data Protection in Kindergarten
The kindergarten handles the personal data of children and their parents on a daily basis. Protecting this data is essential in order to safeguard the privacy of these individuals and to comply with legal requirements such as the GDPR. At heyData, we support kindergartens and their providers in implementing the strict requirements of the GDPR and ensuring the secure handling of sensitive data.
Table of Content
Kindergartens collect a variety of personal data, such as names, addresses and health information. This data may only be collected and used if there is a legal basis or the parents have given their consent. Children deserve special attention here, as they are less aware of the risks and their rights than adults. The General Data Protection Regulation (GDPR) is very important in the context of kindergarten. It stipulates how personal data must be collected, processed, stored, and deleted. This protects children's personal rights and strengthens parents' trust.
Important articles on the GDPR for kindergartens include:
- Art. 8 GDPR: Parental consent for children under the age of 16
- Art. 13 GDPR: Duty to provide information to the data subjects
- Art. 5 GDPR: Principles of data processing, including data minimization and purpose limitation
Collection and Use of Personal Data
The kindergarten may only collect data that is necessary for childcare, such as
- Name, address, and birthday of the child
- Contact information of the parents
- Health data relevant to the care, such as allergies or medication required
Additional data may only be collected with the express consent of the parents. The principle of data minimization must always be observed.
Dealing with Photos in Kindergarten
Photos of children may only be taken and used with parental consent. The consent must also include the specific use of the photos, whether for internal use or publication on the kindergarten's website.
Data Protection Rights of Parents
Parents have the following rights towards the kindergarten under the GDPR
- Right of Access: Access to all processed data
- Right to Erasure: Erasure of data, provided there is no legal obligation to retain it
- Right to Rectification: Correction of incorrect data
- Right to Object: Objection to data processing
Development documentation
The development documentation contains particularly confidential data, e.g. on developmental problems and the child's health, as well as recorded parental and conflict discussions. This sensitive data should always be kept under lock and key.
Portfolios
Portfolios, which contain, for example, handicrafts and observations from everyday life at the daycare center, may be kept freely accessible to the children if it is part of the portfolio concept that the children can look at them at any time. If the portfolios contain sensitive information such as favourite foods, best friends or photos, it is recommended that the portfolios are locked away after use to prevent theft or unauthorized access.
When sending personal data by email, care must be taken to ensure that the information sent cannot fall into the hands of third parties. This can be ensured by encrypting the documents with a password or by storing them in an encrypted zip file. It is also advisable to use a secure online file exchange service through which the encrypted documents can be downloaded by the parents.
Get advice from our experts!
heyData supports you in the implementation of data protection in the kindergarten. Our advice and support ensure the protection of children's privacy and compliance with all legal requirements.
To ensure data protection in the kindergarten, a variety of measures are necessary:
- Technical measures: e.g. password-protected systems, encryption, regular backups.
- Organizational measures: e.g. appointment of a data protection officer, staff training, creation of data protection guidelines.
Data Protection Officer in the Kindergarten
A Data Protection Officer (DPO) in the kindergarten is responsible for ensuring compliance with data protection regulations. Their tasks include
- Monitoring compliance with data protection regulations
- Advising the management and staff on data protection issues
- Training employees on the subject of data protection
- Ensuring the rights of parents and children
You can also choose to work with an external data protection officer such as heyData, who will not only provide you with expert advice but also monitor your data protection activities.
Responding to Data Breaches
If a data breach occurs, you need to act quickly. The GDPR requires data breaches to be reported within 72 hours. With heyData's all-in-one compliance solution, you can ensure that you are well-prepared in the event of an emergency and can respond quickly to data breaches.
At heyData, we are committed to ensuring that nurseries handle the sensitive data of children and parents securely and in compliance with the law. Our team of experts, which consists of experienced fully qualified lawyers, supports you in implementing the GDPR and offers customized solutions for your data protection requirements.
Hear it From Our Customers
"heyData impressed us with their digital software solution and expertise. Like us, heyData is a digital pioneer in a rather traditional and less digital industry. heyData is a strong partner for the BRZ Group."
Markus Schobert
Head of Customer Service at BRZ Gruppe
"heyData is a great help for us and makes the topic of data protection really easy. We are very satisfied with the digital audit, the online training and the customer support."
Leonard von Kleist
CTO & Co-Founder at Hive Technologies GmbH
"I value this feature for its ability to simplify supplier risk assessment. It is an indispensable tool for anyone dealing with data compliance in the European Union and Switzerland."
Jan Stephan
Head of Legal Affairs at Learnship
"As a customer, we have only had good experiences with heyData's support and communication. Questions were answered in detail, responses were always prompt and personal 1-1 support is also no problem."
Roman Georgi
Director Of Customer Support at AMBOSS
“What sets heyData apart is its responsiveness and rapid implementation.”
Sandra Scherzer
Legal department at Bioland
"We always receive competent and prompt advice from heyData and have so far been able to find a satisfactory solution to every question relating to the GDPR or data protection in general."
Nikolai
CTO at Instaffo GmbH
FAQ
A lot of personal data is collected from children in kindergarten, such as names, dates of birth, or health information. This data is particularly worthy of protection, as children are considered particularly vulnerable individuals. The GDPR ensures that this data is handled securely and responsibly.
Kindergartens may only collect data that is necessary for the care and education of the children. This includes contact information of parents, health information for emergencies or information about allergies. All data must be collected with parental consent and may only be used for specified purposes.
Yes, parents must be fully informed about what data is collected, for what purpose and how long it will be stored. This information must be provided in a clear and understandable form, often in a data protection form that parents sign.
Data may only be stored for as long as it is necessary for the purpose for which it was collected. This means that data that is necessary for the care of a child during their time at the kindergarten should generally be deleted when the child leaves the kindergarten.
Breaches of data protection rules can have serious consequences, including fines imposed by the data protection authorities. It is important that kindergartens regularly review their data protection practices and ensure that they comply with the requirements of the GDPR.
Kindergartens must comply with the following main requirements of the GDPR:
- Record of Processing Activities (ROPA): Record all data processing operations, including type of data collected, purpose of processing, storage location, and retention periods.
- Privacy notices: Parents must be informed clearly and comprehensibly about the processing of their children's data.
- Consent: Explicit parental consent must be obtained for certain data processing, such as photos or videos.
- Data Protection Impact Assessments (DPIA): If there are high risks to the rights and freedoms of children, a DPIA must be carried out.
- Technical and Organizational Measures (TOM): Security measures such as encrypted storage and access controls are necessary.
heyData provides support with customized compliance solutions, the provision of documentation, and advice on obtaining and managing consent.