Parents' data rights in childcare: access, export and erasure in practice

Sooner or later it happens: a parent asks for a full copy of their child’s file, or requests that photos be deleted after the child leaves. These are not favours — under GDPR they are rights, and your daycare has one month to respond. Here’s what each right means in practice, and how to handle requests calmly.

The rights parents can invoke

• Access (art. 15). A parent may ask what data you hold about their child and get a copy.
• Rectification (art. 16). Wrong birth date, outdated allergy note? You must correct it.
• Erasure (art. 17). When data is no longer needed — think photos after the child has left — parents can ask you to delete it permanently.
• Portability (art. 20). Parents may receive the data in a structured, machine-readable format, for instance to pass on to a new daycare.

There are limits: invoices must legally be kept for seven years in Belgium, so “delete everything” never means the accounting records. Being able to explain that distinction is part of a good answer.

Why paper and Excel make this hard

With binders, loose spreadsheets and photos spread across phones and WhatsApp, a single access request means hours of searching — and you can never be sure you found every copy. Erasure is worse: deleting a photo from one laptop doesn’t remove the copies elsewhere.

How KidLogg handles each request

In KidLogg, every child’s data lives in one place, which turns each right into a routine action:

• Export in one click. Administrators download a child’s complete file — profile, attendance, daily logs, messages, invoices, documents — as a single structured export.
• Permanent photo erasure. A dedicated erase action removes a child’s photos for good, including the stored files — not just a “hidden” flag.
• Automatic retention. Data that reaches the end of its retention period is purged automatically, so you don’t keep things longer than allowed by accident.
• An audit trail. Every export and erasure is logged, so you can demonstrate afterwards that you handled the request correctly.

A rights request doesn’t have to be a fire drill. With the right tooling it’s a five-minute task — and a moment that shows parents their trust is well placed.

Want to see the export and erasure tools in action? Request a demo.