Sector reference
DPDP for Childcare and Creches
- What is processed
- Watching and monitoring the children in a creche or day care's care, where it is for their safety.
Why it is allowed, and when
The person the children are entrusted to may monitor them for safety without a parent being asked each time. That is the whole of the exception.
Where the permission stops
Monitoring for general purposes, beyond that safety reason, is not covered.
Questions people actually ask
Can a creche monitor my child for safety?
Yes. A creche or day care has a specific allowance to monitor children in its care for their safety, without going through the usual consent process for children's data. Monitoring for anything beyond safety is not covered.
Can a creche use CCTV footage for purposes other than safety (for example showing parents daily activity)?
The allowance is for safety monitoring and nothing else. Using the footage to send parents daily updates, or for marketing, is a separate purpose that needs its own reason, and because a child is involved the children's rules apply on top of that.
How long can a creche keep CCTV footage or photos of my child?
Only while the safety reason it was recorded for still applies, or while another law requires it. Once neither holds it has to be deleted, and the creche has to make any outside vendor it uses delete it too.
There is no period written specifically for creche footage. Two separate one year minimums can still apply, and they cover different things: one is for logs and data kept to detect and investigate unauthorised access, the other is for personal data and the records of what was done with it, held so the purposes the Rules list can be met.
We read the second one as reaching a creche, because it does not narrow who has to keep it and the Rules illustrate it with an ordinary commercial purchase. Some readers take it more narrowly. Either way both are floors rather than deadlines, and they pull against the duty to delete once the reason has gone, so where a floor reaches a particular record, deleting it early is not the safe course either.
The creche uses an outside CCTV company. If footage leaks, who answers for it?
The creche. The law makes the organisation that decided to collect the footage answerable for it, including where the work is done by a company it hired, and it says so whatever the two of them agreed between themselves.
The creche also has to put security terms into that contract rather than take the vendor's word for it, and if footage does leak it is the creche that has to tell the parents and the Data Protection Board.
What people get wrong
You agreed to CCTV, so we can use the footage for our brochure and social media.
The exception covers safety monitoring of the children in your care. Publishing a child's picture is a separate purpose that normally needs a parent's verifiable consent, and it must never tip into anything likely to harm the child's well being.
Daily photo updates in the parents' WhatsApp group are covered by the safety exemption.
They are not. Keeping parents updated is a different purpose from keeping children safe, however well meant it is.
Related questions
- Do I need parental consent for users under 18?
- Is CCTV footage personal data?
- Does CCTV need consent under DPDP?
This sector sits inside the full Sector Reference, which covers 26 sectors and 160 questions. To work through your own organisation rather than the general case, the Template Builder starts from your answers.