🔒 Observations: data protection impact assessment
Draft · 11 October 2026 · decided: keep Ovivio (option C not going ahead) · for the data protection lead to check before it is signed
Could JLK keep children’s observations in our own Hub, as we do in Ovivio, without breaking UK GDPR? Yes, but only with the measures below in place first. This assessment covers three ways of using the tool, from how it works today (it stores nothing) to using it as the full record instead of Ovivio.
This is a working draft based on ICO guidance, not legal advice. Sign it off only once the data protection lead has checked it.
⚠️ Fix this first, whatever we decide
The Hub’s Google Sheets and files are owned by justkidzasc@gmail.com, a personal Gmail account. Care plans, which hold children’s health information, already live there. A personal Gmail account has no business data processing terms with Google, so Google isn’t acting as our processor and we can’t show the data is protected as GDPR requires. Move the sheets, scripts and Drive folders to a Google Workspace business account (on justlittlekidz.co.uk) and accept Google’s data processing terms in the Admin console. Until that is done, store no more children’s information in the Hub.1. What we are assessing
Our observation form (observation.html) helps staff write an observation and link it to Development Matters. Today it stores nothing: staff type no child’s name, and copy the finished text into Ovivio, which is the record. We are assessing three options:
A · Writing aid (today)
Stores nothing. Ovivio is the record.
Low risk
B · Writing aid plus coverage facts
Stores only: child ID, statement ID, date, key person and room. No narrative, no photos, no names in the sheet. Powers the observation-gaps view. Ovivio stays the record.
Medium → Low with measures
C · Full record instead of Ovivio
Observations, photos, assessments, next steps, reports and parent sharing all in the Hub.
High → Medium with measures
Why a DPIA is needed
The ICO expects a DPIA when processing children’s data and when systematically monitoring or assessing people. Observations are both: a continuous assessment of each young child’s development, and they can reveal special category data (health, SEND, religion, ethnicity). Options B and C need a completed DPIA before they start. Option A needs none, but this page records why.
2. The data
| Question | Option B | Option C |
|---|---|---|
| Whose data | Children (0–5); staff as key person | Children; parents (logins, comments); staff |
| What | Child ID, Development Matters statement ID, date, key person, room | Everything in B, plus narrative observations, photos and videos (which may show other children), assessments, next steps, 2-year check, reports, parent comments, any SEND or health notes |
| How many | Every child at three nurseries, every week | Same, plus parents |
| Where | A Google Sheet in the Workspace account, through Apps Script | Sheets for text; a restricted Workspace shared drive for photos |
| Who sees it | Key person, room staff, the manager and directors | Same, plus each child’s own parents (only their child) |
| How long | Until the child leaves, plus 1 term; then deleted automatically | As the retention schedule sets for learning records (handed to parents or the next school when the child leaves, then deleted after the set period) |
3. Lawful basis
- Observation and assessment: Article 6(1)(c) legal obligation. The EYFS statutory framework requires us to observe and assess each child’s progress, do the progress check at two and share it with parents.
- Photos and videos: Article 6(1)(a) consent, taken on the parent contract and permission forms, which parents can withdraw. No photo of a child whose parent hasn’t consented, including in the background.
- SEND or health notes: special category data. Article 9(2)(g) with DPA 2018 Schedule 1 (safeguarding of children; and our appropriate policy document). Keep these in support plans, not in observations.
- Sharing with parents: legal obligation (EYFS), as above.
- Not used for: marketing, social media, or any automated decision about a child.
4. Is it necessary and proportionate?
- Option B is proportionate. Leaders can’t currently see which children or areas have no recent observations across rooms and nurseries. B fixes that with the least data that would work: IDs and dates, not narrative.
- Option C duplicates Ovivio, which already does this under contract. It is only proportionate if we leave Ovivio entirely. Running both doubles the records at risk, doubles subject access work and leaves the two records disagreeing.
5. Risks and measures
| Risk | Before | Measures | After |
|---|---|---|---|
| No processor contract (personal Gmail) | High | Move to a Workspace business account; accept Google’s data processing terms; UK or EU data region if available on the plan | Low |
| Someone who shouldn’t see a child’s record does | High | Staff codes aren’t enough for child records: require a personal Google sign-in (Workspace account) per staff member; show each person only their room or key children; managers their nursery; remove access the day someone leaves | Medium |
| Records seen on a shared tablet or left open | Medium | Observations never on the kiosk screen; auto sign-out after inactivity; device passcodes; nothing saved in the browser | Low |
| Children’s details leak through notifications | Medium | Our standing rule: no child’s name or details in Discord, email subject lines or Hub notices. Alerts say “something to review” and link to the record | Low |
| Photos taken on personal phones, or showing other children | High (C) | Nursery devices only (Mobile phone policy); upload straight to the restricted drive; check consent before saving; nothing kept on the device | Medium |
| Kept longer than needed | Medium | Add the period to the retention schedule; an automatic purge like the handover notes have | Low |
| Data lost or corrupted (a sheet is a fragile database) | Medium | Workspace version history; a weekly export copy; tested restore; edits logged (who, when) | Low |
| Can’t answer a parent’s subject access request in one month | Medium | An export for one child (all records, as a PDF); listed in the SAR procedure | Low |
| Special category data creeps into observations | Medium | Training (Observing well course): describe what the child did, no diagnoses; SEND and health go in support plans | Low |
| We build and run it ourselves, with no supplier security team | High (C) | Keep option B small; for C, a security review before launch and a named person responsible for keeping it maintained | Medium (C) |
6. Using it fully, as we use Ovivio (option C)
For the Hub to replace Ovivio, every item below must exist and be tested before the first real observation goes in. Ovivio already provides these under its contract.
Security and access
- Workspace business account, data processing terms accepted (see the box at the top)
- A personal Google sign-in for every staff member, with two-step verification; no shared logins
- Access by role: key person and room, manager for the nursery, directors for all
- An audit log of who viewed, added, changed or deleted each record
- Leavers removed the same day
The record itself
- Observations with Development Matters links and next steps (the form already does the writing)
- Photos and short videos stored in a restricted shared drive, with a consent check before saving
- Assessment and progress tracking per child, and the gaps view across rooms and nurseries
- The progress check at two and termly summaries, as printable reports
- Edits keep the previous version; deleted records go to a bin before they are purged
Parents
- Parent logins that show only their own child; or, as a smaller start, a PDF learning journal emailed termly
- Parents can add comments and home observations
- Privacy notice updated (Ovivio removed, the Hub described), and parents told before the switch
Rights, retention and leaving
- A one-child export (subject access requests and moving to school)
- Learning journal handed to parents when the child leaves; automatic deletion after the retention period
- Weekly backup copy and a tested restore
- Migration: export every child’s journal from Ovivio, import or archive it, then close the Ovivio account and get Ovivio’s confirmation the data is deleted
Honest view: this is the biggest build the Hub would have. Parent logins, photo storage and keeping it secure for years are the hard parts. It saves the Ovivio subscription and gives one system, but moves all the security responsibility onto us.
✅ Decided 11 October 2026: keep Ovivio
Option C is not going ahead. Ovivio stays the record for observations, learning journals, parents and billing (about £250 a month for three nurseries). Building our own would not save money: personal Google Workspace logins for every staff member cost about the same on their own; invoicing, payments, Tax-Free Childcare and funding claims shouldn't be built in-house; and the security work and risk would move from Ovivio to us. We look again only if Ovivio’s price rises a lot or its parent app lets us down.
Still to do: the Workspace move (for the data already in the Hub), and option B through an Ovivio export if one is available.
7. Recommendation
- Now: move the Hub to a Workspace business account. This matters for the care plans, registers and staff records already there, not only observations.
- Keep option A (stores nothing) until that is done.
- Then option B for the observation-gaps view, or ask Ovivio for an export and use that instead, which stores nothing new in the Hub.
- Option C only as a planned switch away from Ovivio, with every item in section 6 ticked, never running both systems.
8. Sign-off
Option chosen, the data protection lead’s advice and whether the owner followed it. Review this DPIA before any change to what the tool stores, and at least once a year.