Data Protection & Confidentiality (PDPL) Policy

1. Legal Compliance & Scope of Data Protection

Al Nahda Nursery Group is committed to the ethical, confidential, and secure processing of personal information. This policy governs all personal and sensitive data collected from children, parents, authorized collectors, staff, and contractors in accordance with:

UAE Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data (PDPL)
UAE Child Rights Law (Wadeema's Law): Confidentiality provisions protecting children's privacy and dignity
Sharjah Private Education Authority (SPEA): Record retention, institutional governance, and inspection readiness standards

2. Record Storage, Access & Physical Security

All personal records—including birth certificates, Emirates IDs, vaccination records, allergy care plans, and safeguarding chronologies—are maintained under stringent access controls:

Physical Paper Files Locked Filing Cabinets Keys held solely by Principal & Admin

Digital Databases Encrypted & Restricted Role-based access on need-to-know basis

Strict Need-to-Know Access: Only teachers and medical staff directly caring for a child have access to relevant health and dietary records.
No Personal Devices: Staff are strictly prohibited from storing or transmitting child data, photos, or documents on their personal mobile devices.
Retention & Shredding: Child and staff files are retained for a minimum of 1 year following departure (or longer as mandated by authority). Expired records are destroyed via cross-cut shredding.

3. Closed-Circuit Television (CCTV) Governance

CCTV systems operate 24/7 across all ANNS premises to safeguard children, protect staff, and verify premises security:

Strict Privacy Exclusions in Washrooms Under no circumstances are CCTV cameras installed inside child washrooms, changing cubicles, or nappy-changing rooms. Child privacy and dignity are inviolable.

Monitored Coverage Areas: Main reception, corridors, entrance/exit doors, learning classrooms, and outdoor playgrounds.
Footage Retention: Security footage is archived for a maximum of 30 days, after which it is automatically overwritten unless preserved for an active authority investigation.
Restricted Review: Footage may only be viewed or exported by the Nursery Principal and authorized regulatory authorities.

4. Media Consent & Photography Controls

Photography and videography of children are subject to strict consent protocols under UAE law:

Written Parental Consent (Annex D1 / Admission Form Section 5): Before any child photo is captured, parents must explicitly opt-in for internal use (learning journals, wall displays) and/or external use (official website, social media).
No Unauthorized Capture: Visitors, parents, and contractors are strictly prohibited from taking photos or videos of children on nursery premises. Prominent "No Photos / No Mobile Phones" signs are displayed at all entrances.
Nursery-Authorized Devices Only: Documentation photos are taken exclusively on nursery-owned tablets and cameras, never on personal phones.

5. Data Breach Response & Incident Reporting

In the event of suspected loss, unauthorized access, or accidental disclosure of personal data:

1

Immediate Containment

Staff isolate the breach immediately, revoke compromised credentials, and report the event to the Principal within 1 hour.

2

Incident Report Filing (Annex D2)

The incident is documented on the Data Breach / Incident Report (Annex D2) detailing affected data categories, root cause, and immediate mitigations.

3

Parent & Regulatory Notification

If high-risk personal data is compromised, affected parents and relevant UAE data protection authorities are notified without undue delay.

Annex D1: Parent Photo/Video Consent Annex D2: Data Breach Report Annex G1: Staff Confidentiality Declaration