Assessment of legal, digital and data protection requirements for a proposed national childminding register

Date: 17 March 2026

Prepared for: Scottish Government

Context: Assessment of requirements for implementing a national register of children placed with childminders in Scotland

Executive summary

It has been suggested that while a national register of children attending childminding settings could increase transparency, there are “significant legal, digital and data protection barriers” to implementing one. This assessment examines each claimed barrier against the applicable legislation, existing Scottish Government practice, and a working prototype that was built to test the proposition.

The finding is unambiguous: the claimed barriers are standard compliance requirements that every comparable Scottish public service has already addressed. A clear lawful basis exists under UK GDPR and the Data Protection Act 2018 for processing the data a register would require. The digital infrastructure is commodity technology, already deployed at far greater scale and complexity across NHS Scotland, SEEMiS, and the Care Inspectorate's own systems. The data protection requirements (a DPIA, a privacy notice, a retention policy) are routine documents that Scottish public bodies produce regularly. A working prototype of such a system was built in approximately two to three days using open-source tools, at a running cost of zero to twenty-five pounds per month. The prototype collects no children's names, no addresses, no health data, and no special category data of any kind. It stores less personal data than the records a childminder already keeps to meet their regulatory duties (including the Regulation 5 personal plan) and Care Inspectorate expectations.

These are solvable problems, not insurmountable barriers. The characterisation of them as “significant” barriers is not supported by the evidence. What has been described as significant barriers is, in substance, a standard compliance checklist, one that is shorter and simpler than the checklists Scottish public bodies routinely complete for systems that process far more sensitive data about children.

1. Background

1.1 The claimed barriers

It has been argued that while a national register of children attending childminding settings “could increase transparency,” there are “significant legal, digital and data protection barriers” to implementing one. It has further been argued that a register would not prevent malpractice because a childminder “could maintain a legitimate entry on the national register, whilst delivering care to additional children.”

1.2 What the register would do

The purpose of a register is specific and limited: a register that enables the Care Inspectorate to cross-reference the number of children a childminder claims to be caring for against their registered capacity limits. Under the standard conditions of registration set by the Care Inspectorate, a childminder working alone may care for a maximum of 6 children under 12, of whom no more than 3 are not yet attending primary school and no more than 1 is under the age of 1; a further 2 children aged 12 to under 16 may be allowed. The childminder's own children are counted. If the number of children registered to a specific childminder through a central system exceeds those limits, an automatic flag would be raised.

Cases have demonstrated that childminders can care for significantly more children than their registered capacity permits, sometimes without detection between inspection visits. The existing self-reporting model provides no independent mechanism to verify compliance.

1.3 Purpose of this assessment

This document assesses each category of claimed barrier (legal, digital, and data protection) against:

The applicable UK and Scottish legislation
Existing Scottish Government and public body practice
Child-Minder, an independent working prototype built to test these claims (it is not an official Care Inspectorate system)

This assessment also addresses the argument that a register would be ineffective because it cannot prevent deliberate fraud. By that logic, we would not bother with MOT certificates because some drivers still use unroadworthy cars, or with food hygiene ratings because some restaurants still cut corners. No regulatory tool is perfect; the question is whether it meaningfully raises the baseline of accountability.

2. Assessment of “legal barriers”

2.1 Lawful bases available under UK GDPR Article 6

Any processing of personal data requires a lawful basis under Article 6(1) of the UK General Data Protection Regulation (UK GDPR). Which basis applies depends on who operates the system: Article 6(1)(e) (public task) for a Care Inspectorate-operated model, or Article 6(1)(f) (legitimate interests) for a non-public operator.

Article 6(1)(e): public task

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The Care Inspectorate's statutory function under the Public Services Reform (Scotland) Act 2010 is to regulate care services, including childminding services. Part 5 of the 2010 Act sets out the Care Inspectorate's inspection and enforcement powers. Section 44(1)(b) gives the Care Inspectorate the general duty of furthering improvement in the quality of social services. Section 53 empowers it to inspect any social service, and section 60(2) allows it to grant registration subject to such conditions as it thinks fit: the basis of each childminder's conditions of registration. If the Care Inspectorate were to operate a system enabling cross-referencing of capacity compliance, that processing would be a direct exercise of these statutory functions.

The “public task” basis is the most commonly used lawful basis across Scottish public bodies for regulatory data processing. It is the basis on which the Care Inspectorate already processes data about childminders, their services, and their conditions of registration.

Article 6(1)(f): legitimate interests

Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

If the register were operated by a body other than a public authority (for example, a third-sector organisation or a social enterprise), legitimate interests would be available as a lawful basis. The legitimate interest (safeguarding children from being placed in over-capacity childminding settings) is clear and compelling. A balancing test under Article 6(1)(f) would weigh this interest against the rights of the data subjects (parents submitting their own data voluntarily, and childminders whose registration data is already public). Given the minimal nature of the data processed and the voluntary participation model, the balance clearly favours processing.

Note: Article 6(1) explicitly states that subparagraph (f) “shall not apply to processing carried out by public authorities in the performance of their tasks.” If the Care Inspectorate were to operate the system, Article 6(1)(e) (public task) would be the appropriate basis, not legitimate interests.

Why Article 6(1)(c) (legal obligation) is not relied upon

Article 6(1)(c) applies only where processing is necessary for compliance with a legal obligation to which the controller itself is subject. The Requirements for Care Services (Scotland) Regulations 2011 (SSI 2011/210) place duties on care service providers, including childminders (not on the Care Inspectorate), and no legislation currently obliges the Care Inspectorate, or anyone else, to operate a placement register of this kind. Article 6(1)(c) is therefore not an available basis. The position would need to be revisited only if future legislation placed a specific duty on the controller to maintain such a system.

2.2 Special category data under Article 9

Article 9 of the UK GDPR imposes additional conditions on the processing of “special categories” of personal data, defined as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a person's sex life or sexual orientation.

The Child-Minder prototype collects no special category data whatsoever. The prototype holds:

Parent email address (for authentication)
Child birth year and month (not full date of birth, not name, not address)
A system-generated pseudonymous child reference (e.g., “CM-A7F9B2”)
Childminder registration number (already published on the Care Inspectorate website)
Placement start and end dates

None of these data points falls within any special category under Article 9. No health data, no developmental information, no ethnicity, no religion, no photographs, no biometric data. The Article 9 conditions are therefore not engaged. Even if special category data were required (which it is not), the Data Protection Act 2018 provides explicit conditions:

Schedule 1, Condition 18: safeguarding of children and individuals at risk. Processing is necessary for the purposes of protecting children or individuals at risk from neglect, physical, mental or emotional harm. This condition explicitly contemplates the type of processing a childminding register would involve.

Schedule 1, Condition 2: health or social care purposes. Processing is necessary for health or social care purposes. Childminding is a registered care service under Scottish law.

Both conditions require an Appropriate Policy Document, which is a standard compliance document (discussed further in Section 4).

2.3 The Named Person ruling

The Named Person ruling is frequently raised in Scottish policy discussions about children's data. It merits direct address.

In Christian Institute v Lord Advocate [2016] UKSC 51, the UK Supreme Court held that the information-sharing provisions of Part 4 of the Children and Young People (Scotland) Act 2014, which would have required Named Persons to share information about children's “wellbeing”, were outside the legislative competence of the Scottish Parliament, so could not be brought into force. The Court held that the information-sharing provisions were not “in accordance with the law” because they lacked sufficient precision and safeguards about:

What information would be shared
With whom it would be shared
Under what circumstances sharing would occur
What safeguards applied

The Court was clear: it was not ruling that maintaining records about children is unlawful, or that information-sharing for child protection purposes is impermissible. It was ruling that the specific legislative provisions at issue were too imprecise. Paragraph 91 of the judgment describes the aim of the Act as “unquestionably legitimate and benign”. The deficiency was in precision of drafting, not in the underlying objective. This is a design constraint (be precise about data access rules), not a legal barrier to creating a register. The Child-Minder prototype directly addresses this constraint. Data access rules are encoded in Row-Level Security (RLS) policies at the database level:

Parents can only see their own children's records and placements
Inspectors can see capacity data for all active childminders, but cannot see which parent registered which child
No child names are stored at any level
Every data access is logged in an audit table with timestamps, user identification, and the operation performed

The Named Person ruling requires precisely the kind of technical specificity that the prototype demonstrates. It is evidence that the constraint is achievable, not that the objective is unlawful.

2.4 Conclusion on legal barriers

A clear lawful basis exists under UK GDPR Article 6 for the processing that a childminding register requires: Article 6(1)(e) for a Care Inspectorate-operated model, or Article 6(1)(f) for a non-public operator. No special category data is involved, but even if it were, the DPA 2018 provides explicit safeguarding conditions. The Named Person ruling is a design constraint about precision, not a prohibition on maintaining records. The legal framework actively supports, rather than hinders, processing data to protect children.

There is no legal barrier to creating a system of this kind. What exists is a set of legal requirements (lawful basis selection, privacy notices, data access rules) that are standard compliance steps, well-precedented, and straightforward to implement.

3. Assessment of “digital barriers”

3.1 Existing digital infrastructure

The claim that digital barriers exist must be assessed against what Scottish public bodies already operate.

Care Inspectorate CI Digital portal

The Care Inspectorate already operates a digital portal at portal.careinspectorate.gov.scot for the registration, variation, and management of care services including childminding. Childminders submit applications, report changes to their registration, and file annual returns through this portal. The digital infrastructure for interacting with childminding services already exists within the Care Inspectorate.

Adding a parent-facing registration function (“I am placing my child with childminder registration number X”) is an incremental extension of an existing digital system, not the construction of a new one.

SEEMiS

SEEMiS Group LLP, owned jointly by Scotland's 32 local authorities, operates the schools management information system used across approximately 2,500 schools and 2,000 early learning and childcare (ELC) settings. SEEMiS processes far more data about far more children than a childminding register would require: full names, dates of birth, addresses, health information, attendance records, attainment data, and pastoral notes. The system has operated at national scale for over a decade.

If Scotland's local authorities can operate a system processing sensitive data for hundreds of thousands of children across thousands of settings, a register processing minimal data for approximately 22,000 children across approximately 3,000 childminders is not a digital challenge.

NHS Child Health Information Services (CHIS)

NHS Scotland maintains digital health records for every child born in Scotland from birth through childhood immunisation, developmental screening, and school health assessments. The Child Health Information Services system processes the most sensitive category of personal data (health records) for every child in the country. It has done so for decades.

Other Scottish Government digital services

Police Scotland's PVG (Protecting Vulnerable Groups) scheme processes disclosure checks digitally
HMRC's Real Time Information system processes payroll data for every employer in Scotland
Social Security Scotland's digital platform processes benefit applications and payments
Revenue Scotland operates digital systems for Land and Buildings Transaction Tax

3.2 The prototype as evidence

A working prototype, Child-Minder, was built in approximately two to three days using commodity open-source technology.

Technology stack:

Next.js (open-source web framework, MIT licence)
Supabase (open-source database platform, Apache 2.0 licence)
PostgreSQL (open-source relational database, PostgreSQL licence)

Infrastructure cost: Zero to twenty-five pounds per month. Both Supabase and Vercel offer free tiers sufficient for the scale of Scottish childminding (approximately 3,000 providers, approximately 22,000 children). Even at production scale with paid tiers, costs would be measured in tens of pounds per month, not thousands.

Database schema: Approximately 400 lines of SQL across 7 migration files, implementing:

6 tables (user profiles, childminders, children, placements, capacity alerts, audit log)
Row-level security policies with role-based access control
Automated capacity checking with breach and warning alerts
A comprehensive audit trail with timestamps, user identification, and operation logging
Pseudonymous child references (system-generated, e.g., “CM-A7F9B2”)

No custom hardware. No bespoke procurement. No lengthy vendor selection. No mainframe. No proprietary software. The entire system runs on commodity cloud infrastructure available from dozens of providers.

3.3 Comparison with analogous government digital services

System	Operator	Users	Data Volume	Technology
SEEMiS	32 local authorities	Thousands of staff	~700,000 pupil records	Bespoke MIS
NHS CHIS	NHS Scotland	NHS staff Scotland-wide	Every child in Scotland	NHS Digital systems
PVG Scheme	Disclosure Scotland	Employers + individuals	Millions of checks	Digital platform
CIS (HMRC)	HMRC	Construction contractors	Millions of subcontractors	HMRC digital
CI Digital Portal	Care Inspectorate	Care service providers	~12,000 registered services	Web portal
Child-Minder (proposed)	Care Inspectorate (proposed)	~3,000 childminders + parents	~22,000 child records	Open-source web app

Child-Minder would be the smallest, simplest system in this comparison by every measure: fewest users, least data, simplest technology, lowest cost.

3.4 Conclusion on digital barriers

No digital barrier exists. The technology required is commodity, well-understood, and already deployed at far greater scale and complexity across Scottish public services. A working prototype was built in days, not months, using freely available open-source tools. The Care Inspectorate already operates a digital portal for childminding services. The claim that digital barriers are “significant” is not supported by the evidence.

4. Assessment of “data protection barriers”

4.1 What Child-Minder actually collects

The following table compares the data held by Child-Minder against data that existing systems already collect about children in Scotland.

Data Point	Child-Minder	Childminder's Own Records (regulatory duties and Care Inspectorate expectations)	SEEMiS (Schools)	NHS CHIS
Child's full name	No	Yes	Yes	Yes
Child's date of birth	Year and month only	Full DOB	Full DOB	Full DOB
Child's address	No	Yes	Yes	Yes
Health data (allergies, conditions)	No	Some (allergies, medications)	Some	Full medical records
Developmental information	No	No	Yes (attainment)	Yes (screening)
Parent/guardian name	No	Yes	Yes	Yes
Parent/guardian full contact details	Email only	Full details (phone, address)	Full details	Full details
Emergency contacts	No	Yes	Yes	Yes
Ethnicity	No	No	Sometimes	Sometimes
Religion	No	No	Sometimes	No
Photographs	No	No	Sometimes	No
GP details	No	Sometimes	No	Yes
Financial information	No	No	Free school meals status	No
Safeguarding concerns	No	Some	Yes	Yes

Child-Minder collects the absolute minimum data required for its purpose: matching children to childminders for capacity checking. It collects less personal data than any other children's data system in Scotland, and less than the records a childminder already keeps to meet their regulatory duties (including the Regulation 5 personal plan) and Care Inspectorate expectations.

4.2 No special category data

The prototype holds no data classified as special category under Article 9 of the UK GDPR. This is by design. The prototype implements what data protection law calls “data minimisation” (Article 5(1)(c)) and “data protection by design and by default” (Article 25).

Specifically:

No child names: Children are identified by system-generated pseudonymous references (e.g., “CM-A7F9B2”). The prototype never asks for, stores, or displays a child's name.
No child addresses: Not collected. Not needed for capacity checking.
No health data: Not collected. Not needed for capacity checking.
Partial date of birth only: The prototype stores birth year and month, not the full date of birth. This is sufficient to calculate the age bracket (under 1, preschool, under 12, under 16) required for capacity limit checking. It is not sufficient to identify a specific child.
No parent names: Parents authenticate with an email address. Their name is never requested.

4.3 ICO Age Appropriate Design Code

The ICO's Age Appropriate Design Code (also known as the Children's Code) sets out 15 standards of age-appropriate design for “information society services” (ISS) likely to be accessed by children.

The Code is unlikely to apply to a childminding system if operated by the Care Inspectorate, for three reasons:

Not a commercial service: The Code applies to ISS as defined in the Electronic Commerce (EC Directive) Regulations 2002. An ISS must be provided “normally for remuneration.” A public authority register operated as a regulatory function is not provided for remuneration.

Not accessed by children: The Code applies to services “likely to be accessed by children.” A childminding register is used by parents (adults) and inspectors (adults). Children do not access or interact with it.

Public authority exemption: Even if the Code applied, it provides that public authorities exercising their official functions should consider the standards. The Care Inspectorate's statutory regulatory functions are not ISS.

Even if the Code did apply, the Child-Minder prototype's data-minimisation-first design would satisfy its requirements. Standard 8 (Data Minimisation) requires that only the minimum amount of personal data necessary is collected. Child-Minder collects no names, no addresses, and no health data. Standard 10 (Geolocation) is not engaged: no location data is collected. Standard 12 (Profiling) is not engaged: no profiling takes place.

The Age Appropriate Design Code is not a barrier. It is unlikely to apply, and if it did, the prototype's design would comply.

4.4 Data protection impact assessment (DPIA)

Article 35 of the UK GDPR requires a Data Protection Impact Assessment where processing is “likely to result in a high risk to the rights and freedoms of natural persons.” Processing involving children's data at scale may meet this threshold, making a DPIA advisable.

A DPIA is a document, not a barrier. It requires:

A systematic description of the processing operations and their purposes
An assessment of the necessity and proportionality of the processing
An assessment of the risks to data subjects' rights and freedoms
The measures envisaged to address the risks

The Scottish Government has already completed DPIAs for comparable or more complex processing:

ELC 2-year-old data sharing project: DPIA for sharing children's data between HMRC, DWP, the Scottish Government, and local authorities to identify eligible 2-year-olds for funded childcare. This involved sharing full names, dates of birth, addresses, and benefits data, substantially more sensitive than anything Child-Minder would process.
NHS Scotland DPIAs: Routinely produced for processing children's health data.
Social Security Scotland DPIAs: Produced for benefit processing systems that handle data about families with children.

The Child-Minder prototype's risk profile is low due to extreme data minimisation. No names, no addresses, no health data, no special category data. The DPIA for Child-Minder would be one of the simplest child-related DPIAs a Scottish public body has ever been required to produce.

A separate document (see `dpia-outline.md`) provides a draft outline of what a DPIA for Child-Minder would contain.

4.5 Appropriate policy document (APD)

Where processing relies on a substantial public interest condition under DPA 2018 Schedule 1, an Appropriate Policy Document is required. This is a standard document that sets out:

The lawful basis for processing
The condition relied upon
How the controller complies with the data protection principles
Retention periods

APDs are produced routinely by Scottish public bodies. The ICO provides template guidance. An APD for Child-Minder would be straightforward given the minimal data processed and the clear lawful basis.

4.6 Privacy notice

Articles 13 and 14 of the UK GDPR require a privacy notice to be provided to data subjects, explaining what data is collected, why, the lawful basis, retention periods, and their rights. This is a standard requirement for every data controller in the United Kingdom.

A draft privacy notice for Child-Minder is provided in a separate document (see `privacy-notice.md`).

4.7 Data retention

A data retention policy is a standard requirement. For Child-Minder, a suggested approach is:

Active placements: Retained while the placement is active
Ended placements: Retained for 3 years after the child leaves the childminding setting (consistent with regulatory record-keeping requirements and limitation periods for civil claims)
After retention period: Pseudonymise or delete. Since child records already use system-generated pseudonymous references and contain no names or addresses, deletion of the placement record itself is straightforward.

4.8 Conclusion on data protection barriers

The data protection requirements for a childminding register are standard compliance measures that every Scottish public body routinely addresses. They consist of:

A DPIA (a document the Scottish Government has produced for more complex children's data processing)
A privacy notice (required for every data controller)
A retention policy (standard practice)
An APD (if relying on a Schedule 1 condition, which is likely unnecessary given that no special category data is processed)
ICO registration (standard for all data controllers)

The Child-Minder's extreme data minimisation (no names, no addresses, no health data) makes it one of the lowest-risk children's data systems conceivable. It processes less personal data than the records a childminder already keeps to meet their regulatory duties (including the Regulation 5 personal plan) and Care Inspectorate expectations. Describing these routine compliance steps as “significant barriers” to protecting children from being placed in over-capacity care settings is not a proportionate characterisation.

5. Comparison with existing systems processing children's data

The following table places Child-Minder alongside existing Scottish systems that process children's data, all of which operate with full legal compliance.

System	Operator	Data Held	Approximate Scale	Primary Lawful Basis
SEEMiS	32 local authorities	Full name, DOB, address, health notes, attainment, attendance, pastoral notes, free school meal status	~2,500 schools + ~2,000 ELC settings; ~700,000 pupils	Public task (Art 6(1)(e))
NHS CHIS	NHS Scotland	Full medical records from birth: immunisation, developmental screening, health visitor notes, GP details	Every child born in Scotland	Health/social care (Art 9(2)(h)) + public task
Social Work Case Management	Local authorities	Highly sensitive safeguarding data: risk assessments, family circumstances, child protection plans, court orders	Thousands of children across 32 authorities	Substantial public interest (Art 9(2)(g)) + legal obligation
ELC Data Sharing (2-year-olds)	SG + HMRC + DWP + LAs	Names, DOBs, addresses, benefits data, eligibility assessments	All eligible 2-year-olds in Scotland	Regulations under Digital Economy Act 2017
PVG Scheme	Disclosure Scotland	Criminal records, vetting information, barred list status	All individuals working with children/protected adults	Legal obligation (Art 6(1)(c)) + substantial public interest
Childminder's Own Records	Individual childminders	Full name, DOB, address, parent details, emergency contacts, health/allergy info, attendance	All children in each setting (to meet SSI 2011/210 duties, including the reg 5 personal plan, and Care Inspectorate expectations)	Legal obligation (Art 6(1)(c))
Child-Minder (proposed)	Care Inspectorate (proposed)	Email, birth year/month, pseudonymous child ref, placement dates, childminder reg number	~3,000 childminders; ~22,000 children	Public task (Art 6(1)(e))

Every system above Child-Minder in this table processes more sensitive data about more children with greater complexity than Child-Minder would require. All operate lawfully. All have completed the compliance steps (DPIAs, privacy notices, retention policies, APDs) that have been cited as barriers. Child-Minder would collect the least data of any children's data system in Scotland.

6. What is actually required (the compliance checklist)

The following items are genuine requirements for deploying a childminding register. None of them is a barrier. All are routine, well-precedented, and achievable within weeks, not months or years.

6.1 Data protection impact assessment

Status: Required under Article 35 UK GDPR where processing is likely to result in high risk. Advisable in any case for processing involving children's data.

Precedent: The Scottish Government has completed DPIAs for the ELC 2-year-old data sharing project and numerous NHS Scotland and Social Security Scotland projects, all involving more sensitive data than Child-Minder.

Effort: A DPIA for Child-Minder would be one of the simplest child-related DPIAs produced by a Scottish public body, given the extreme data minimisation. An outline is provided in `dpia-outline.md`.

6.2 Appropriate policy document

Status: Required under DPA 2018 Schedule 1 if relying on a substantial public interest condition. Likely unnecessary for Child-Minder since no special category data is processed, but advisable as good practice.

Precedent: Standard document produced by every Scottish public body that processes personal data under a public interest condition.

Effort: Template available from ICO. Straightforward to complete for Child-Minder.

6.3 Privacy notice

Status: Required under Articles 13/14 UK GDPR for all data controllers.

Precedent: Every data controller in the UK publishes a privacy notice. A draft for Child-Minder is provided in `privacy-notice.md`.

Effort: Half a day to draft; standard legal review.

6.4 Data retention policy

Status: Required as part of the accountability principle (Article 5(2) UK GDPR).

Precedent: Standard across all data controllers.

Effort: Decision on retention periods (suggested: 3 years post-placement), documented in a standard policy.

6.5 Lawful basis selection and documentation

Status: Required under Articles 5 and 6 UK GDPR.

Precedent: Article 6(1)(e) (public task) is the basis most commonly relied upon by Scottish public bodies for regulatory processing. Article 6(1)(c) (legal obligation) is not relied upon, because no legal obligation requires the Care Inspectorate to operate such a system (see Section 2.1).

Effort: Straightforward selection and documentation. The analysis in Section 2 of this document provides the reasoning.

6.6 Technical security measures

Status: Required under Article 32 UK GDPR (security of processing).

Precedent: Row-level security, encryption at rest, audit trails, and pseudonymous identification are all standard technical measures.

The Child-Minder prototype already implements:

Row-level security policies ensuring parents can only access their own children's records
Role-based access control separating parent and inspector access
A comprehensive audit trail logging every data operation with user identification and timestamp
System-generated pseudonymous child references (no names stored)
Encryption at rest (provided by the database platform)
Enforcement of the unique active placement constraint (a child cannot be registered to the same childminder twice simultaneously)

6.7 ICO registration

Status: Required for all data controllers under the Data Protection Act 2018, section 25.

Effort: Online registration form. The Care Inspectorate is already registered with the ICO.

6.8 Summary

Requirement	Template/Precedent Available	Estimated Effort	Status in Prototype
DPIA	Yes (ELC project, ICO template)	1-2 weeks	Outline drafted
APD	Yes (ICO template)	2-3 days	Not required (no special category data)
Privacy Notice	Yes (ICO guidance)	1-2 days	Draft provided
Retention Policy	Yes (standard practice)	1-2 days	Architecture supports it
Lawful Basis Documentation	Yes (Article 6(1)(e))	1-2 days	Analysis provided
Technical Security	Yes (prototype demonstrates)	Already built	RLS, audit trails, pseudonymous IDs
ICO Registration	Already registered	Update existing entry	N/A

Total estimated compliance effort: 2-4 weeks of work, with templates and precedents available for every item.

7. Conclusion

The characterisation of legal, digital, and data protection requirements as “significant barriers” to a system such as Child-Minder is not supported by the evidence.

On legal barriers: A clear lawful basis exists under UK GDPR Article 6(1)(e) (public task) for a Care Inspectorate-operated model. The Data Protection Act 2018 explicitly provides safeguarding conditions. The Named Person ruling is a design constraint about precision, not a prohibition. The legal framework supports, rather than hinders, the creation of such a register.

On digital barriers: The technology is commodity and open-source. A working prototype was built in days. The Care Inspectorate already operates a digital portal for childminding services. SEEMiS, NHS CHIS, and multiple other Scottish systems process more data about more children at greater scale. There is no digital frontier to cross.

On data protection barriers: The compliance requirements are a standard checklist: DPIA, privacy notice, retention policy. Every item has templates and precedents from existing Scottish Government work. The Child-Minder's extreme data minimisation (no names, no addresses, no health data, no special category data) makes it one of the simplest children's data compliance exercises conceivable.

What has been described as significant barriers is, in substance, a compliance checklist of routine items that Scottish public bodies address regularly for systems that process far more sensitive data. The real question is not whether these compliance steps can be completed (they self-evidently can) but whether there is the political and administrative will to complete them.

Experience has demonstrated that childminders can exceed their registered capacity limits without detection under the current self-reporting model. A register of the type described in this assessment (minimal data, automated capacity checking, pseudonymous child identification) would have flagged this breach. The technology exists. The law permits it. The compliance steps are routine. The only barrier is the decision to proceed.

References

Legislation

UK General Data Protection Regulation (UK GDPR), retained EU law
Data Protection Act 2018, c. 12
Public Services Reform (Scotland) Act 2010, asp 8
Requirements for Care Services (Scotland) Regulations 2011, SSI 2011/210
Children and Young Persons (Scotland) Act 1937, c. 37
Children and Young People (Scotland) Act 2014, asp 8
Digital Economy Act 2017, c. 30

Case law

Christian Institute v Lord Advocate [2016] UKSC 51

Regulatory guidance

ICO, “Data Protection Impact Assessments” (guidance), ico.org.uk
ICO, “Lawful Basis for Processing” (guidance), ico.org.uk
ICO, “Age Appropriate Design Code” (2020), ico.org.uk
ICO, “Children and the UK GDPR” (guidance), ico.org.uk

Scottish Government / public body sources

Care Inspectorate, “Early Learning and Childcare Statistics 2024”
Care Inspectorate, CI Digital portal (portal.careinspectorate.gov.scot)
SEEMiS Group LLP (seemis.gov.scot)
Scottish Government, “Getting It Right for Every Child (GIRFEC)” framework

Compliance analysis