Purpose

To protect systems, records and users from unauthorised access, loss, misuse and avoidable disruption.

Policy commitment

The organisation will apply this policy lawfully, fairly, consistently and proportionately. Decisions will be based on evidence, individual circumstances, identified risk and the rights of affected people. Safeguarding action will not be delayed because information is incomplete where a child may be at risk.

Scope, principles and rights

Who and what this policy covers

This policy applies to directors, employees, workers, contractors, volunteers and anyone acting on behalf of the organisation. It applies to relevant work carried out in homes, schools, community settings, offices, transport, telephone contact, digital services, remote sessions, record keeping and communication with families or partner agencies.

Core principles

• The welfare and safety of children are central to safeguarding decisions.
• People will be treated with dignity, respect and without unlawful discrimination.
• Children and families should be listened to and involved in decisions affecting them wherever this is safe and lawful.
• Action must be necessary, proportionate, recorded and capable of professional scrutiny.
• Information should be accurate, relevant, secure and shared only with people who need it for a lawful purpose.
• Concerns must be escalated when risk remains unresolved; professional disagreement must never leave a child without protection.

Rights and fair treatment

• Individuals have the right to be treated fairly and consistently and to have protected characteristics respected.
• Privacy and data-protection rights will be respected, while recognising that safeguarding information may be shared without consent when there is a lawful basis and this is necessary to protect a child or another person.
• Children should receive information in a way they can understand, including reasonable communication adjustments where needed.
• Workers may raise genuine concerns without retaliation through safeguarding, management or whistleblowing routes.
• Anyone affected by a decision may use the organisation’s complaints, review or appeal route where one applies, without that preventing urgent safeguarding action.

Roles, accountability and competence

Senior leadership

• Approve the policy, allocate resources and ensure governance arrangements are effective.
• Maintain clear lines of accountability, escalation and external reporting.
• Review significant incidents, patterns, complaints and assurance findings.

Policy owner

• Keep the policy, procedures, legal references and local contacts under review.
• Provide advice and ensure role-appropriate training and supervision are available.
• Monitor implementation, overdue actions, recurring concerns and quality of records.
• Escalate material risks, failures or legal changes to senior leadership.

All workers

• Read and follow the current approved policy and related procedures.
• Work within competence and seek advice where thresholds, duties or authority are unclear.
• Report concerns, incidents, allegations, errors and breaches promptly.
• Keep factual, timely records and cooperate with reviews and statutory enquiries.
• Maintain professional boundaries and use approved communication and information systems.

Competence and supervision

Induction must identify the responsibilities relevant to each role. Refresher training, supervision and additional instruction must be provided when duties, law, guidance, risk or service arrangements change.

Operational procedure

The following steps are specific to Secondary Recovery and Cloud Backup Policy and must be read with local safeguarding, emergency and escalation arrangements.

1. Step 1Identify when Secondary Recovery and Cloud Backup Policy applies and who is responsible for the immediate decision.
2. Step 2Consider immediate safety, rights, accessibility, foreseeable risk and any safeguarding implications before acting.
3. Step 3Use approved processes, systems and communication routes; do not improvise outside role, competence or authority.
4. Step 4Record relevant facts, decisions, reasons, people consulted, actions, owner and timescale clearly and promptly.
5. Step 5Escalate urgent, unresolved, statutory or high-risk matters through the appropriate management, safeguarding, emergency or external route.
6. Step 6Review the outcome, capture feedback or learning and update connected practice, training, forms or controls where improvement is needed.

Decision making and proportionality

• Identify the immediate issue, people affected and any urgent safety requirement.
• Separate fact, professional judgement and unverified information in records.
• Consider vulnerability, communication needs, disability, age, power imbalance and the wider context.
• Use the least intrusive effective action that is consistent with safety and legal duties.
• Set a named owner, action, timescale and review point for every material concern.

Emergency and external escalation

Where there is immediate danger, serious injury, suspected crime or a child may be at risk of significant harm, workers must use the relevant emergency or statutory route without waiting for an internal meeting. Internal notification should follow as soon as it is safe to do so.

Records, information sharing and confidentiality

Recording standard

• Record the date, time, source, people present, factual observations, direct words where relevant, actions taken and reasons for decisions.
• Correct errors transparently; do not silently overwrite safeguarding or governance records.
• Link related incidents so patterns can be identified while preserving appropriate access controls.

Information sharing

Information must be handled in accordance with applicable data-protection law and safeguarding duties. Consent should be considered where appropriate, but it is not the only lawful basis for sharing. Where information is shared without consent, the purpose, lawful basis, necessity, proportionality, recipient and decision should be recorded.

Confidentiality

Confidentiality is not absolute. Information should be restricted to those who need it, but workers must never promise secrecy where a safeguarding or legal duty may require disclosure.

Retention and security

• Use approved systems, accounts and devices.
• Apply role-based access and secure transfer methods.
• Retain records for the period set by the organisation’s records schedule and any applicable statutory or contractual requirement.
• Report data loss, unauthorised access or disclosure promptly under the data-breach procedure.

Equality, safeguarding and challenge

Equality and reasonable adjustments

The policy must be applied without unlawful discrimination. Reasonable adjustments and accessible communication should be considered for disabled people and others who need support to understand, participate or communicate.

Safeguarding and anti-discriminatory practice

Workers should remain alert to the effect of racism, discrimination, harassment, exploitation, coercion, disability, communication barriers and unequal power. Stereotypes must not be used as a substitute for evidence or individual assessment.

Concerns about practice

• Workers should challenge unsafe, unlawful or discriminatory practice.
• Safeguarding concerns must be escalated through the designated safeguarding route.
• Concerns about a worker may require separate allegation, low-level concern, disciplinary, regulatory or LADO processes depending on the facts and threshold.
• Whistleblowing routes remain available where normal management reporting is inappropriate or has not resolved a serious concern.

Complaints and feedback

Complaints will be acknowledged, recorded, investigated fairly and responded to within the organisation’s published process. A complaint must not obstruct immediate action required to protect a child or preserve evidence.

Implementation, monitoring and review

Implementation

• The policy owner will identify affected roles and communicate changes before implementation where practicable.
• Managers will check that workers know how to access the policy and any forms, systems or external contacts it requires.
• Operational changes arising from the policy will be assigned to named owners and tracked to completion.

Monitoring and assurance

• Review incidents, complaints, referrals, near misses, audit findings and recurring themes.
• Sample records for timeliness, factual accuracy, decision rationale and completion of follow-up actions.
• Use lessons from cases and feedback to improve practice, training and controls.

Breaches

Failure to follow this policy may lead to corrective action, additional supervision or training, restriction of duties, disciplinary or contractual action, safeguarding referral, regulatory notification or referral to another authority where appropriate. Any response must be fair, proportionate and consistent with employment, contractual and legal rights.

Review triggers

This policy will be reviewed by the stated review date and sooner following significant incidents, audit findings, service changes, new risks, relevant case learning or changes to legislation, statutory guidance or regulatory expectations.

Legal and guidance framework

This policy should be read in the context of the organisation’s jurisdiction, sector and actual regulated activities. The following framework is relevant to this template and must be checked for applicability before approval.

• UK GDPR
• Data Protection Act 2018
• Computer Misuse Act 1990
• Applicable contractual and security obligations

Related organisational documents

• Safeguarding and Child Protection Policy
• Risk Assessment and Incident Reporting Procedures
• Data Protection, Privacy and Records Management Policies
• Complaints and Whistleblowing Policies
• Safer Recruitment, Conduct and Professional Boundaries Policies

Approval and implementation record

Implementation checklist

• ☐ Policy reviewed for the organisation’s actual services and jurisdiction.
• ☐ Legal and statutory-guidance references checked for current applicability.
• ☐ Local authority, safeguarding, regulator and emergency contacts verified where relevant.
• ☐ Staff roles, training and supervision requirements assigned.
• ☐ Related forms, reporting routes and records systems tested.
• ☐ Approval recorded and superseded versions controlled.

© 2026 Organisation. Customised policy template for internal organisational use.