Safeguarding, Child Protection& Data Protection Policy and Procedures
Safeguarding, Child Protection & Data Protection Policy and Procedures Scribbly & Still
​
Policy owner / Child Protection Lead
Louise Robertson, owner of Scribbly & Still
​
Applies to
All Scribbly & Still activities involving children and young people under 18
​
Version
1.1 - 10 September 2026 (GDPR procedures added)
​
Review
At least annually, and sooner after a concern, incident, significant change in guidance/law, or change in service Key local areas currently served East Lothian and City of Edinburgh
​
Purpose of this policy
To keep children safe, make it easy for adults and children to raise worries, and set out exactly what Scribbly & Still will do when there is a safeguarding or child protection concern. This policy is designed for a small, owner-led organisation and applies to any future staff, volunteers, contractors, or helpers.
1. Our safeguarding commitment
Scribbly & Still believes every child has the right to feel safe, be listened to, be treated with dignity and respect, and receive help when they need it. Safeguarding is broader than responding to abuse: it includes creating safe activities, reducing foreseeable risks, respecting children’s rights and voices, and responding early when a child’s wellbeing may be affected.
​
Child protection is the action taken when there is concern that a child may be experiencing, or may be at risk of, abuse, neglect or significant harm. Child protection is everyone’s responsibility.
The child’s safety and wellbeing come first.
​
Children will be listened to and taken seriously.
​
Children will be involved, in a way they can understand, in decisions that affect them wherever it is safe and appropriate to do so.
Discrimination, bullying, abuse, exploitation and harmful behaviour are not accepted.
​
Information will be shared only when necessary, proportionate and lawful. A child protection concern will be shared with Police or Social Work without delay when required to protect a child.
No adult will promise a child complete secrecy about a safety concern.
​
2. Scottish framework and standards used
This policy has been written with reference to the National Guidance for Child Protection in Scotland 2021 (updated 2023), the GIRFEC policy and practice framework, the Children and Young People (Scotland) Act 2014 wellbeing framework, the UN Convention on the Rights of the Child (UNCRC), current Disclosure Scotland/PVG requirements, and the Edinburgh and the Lothians multi-agency child protection procedures.
​
GIRFEC is used as a practical way of thinking about a child’s whole wellbeing. Scribbly & Still will consider the eight SHANARRI wellbeing indicators: Safe, Healthy, Achieving, Nurtured, Active, Respected, Responsible and Included. This does not replace child protection procedures: where there is a child protection concern, protection action takes priority.
​
The National Guidance expects services to have clear processes for identifying, sharing and acting on concerns. Scribbly & Still follows that principle and will work with Police, Social Work, education, health and other relevant services when needed.
​
3. Roles and accountability
​
Roles and Responsibilities
​
Child Protection Lead - Louise Robertson.
Responsible for maintaining this policy, receiving and recording concerns, making referrals, keeping knowledge and training current, securely storing child protection records, and reviewing safeguarding practice.
​
Sole-owner safeguard
​
Because Louise is currently the sole owner/employee, there is no internal deputy or senior manager. A concern or allegation about Louise must NOT be handled by Louise as the decision-maker. It should be reported directly to Police or the relevant local authority Social Work/Children’s Services. A parent, child, venue, partner organisation or other adult may report directly.
​
Future staff/volunteers/contractors
​
Before working with children, they must receive safeguarding induction, understand this policy and code of conduct, know how to report concerns, and complete any legally required safer recruitment/PVG checks.
​
4. Safer recruitment and suitability
​
Scribbly & Still will not rely on a PVG disclosure alone. For any future role involving children, safer recruitment will include proportionate checks appropriate to the role.
​
Confirm whether the role is a regulated role under current Scottish law before the person starts.
​
Ensure required PVG scheme membership is in place before a regulated role begins.
​
Use a role description, application or suitability conversation, identity checks and appropriate references.
​
Ask about relevant gaps, concerns or restrictions where lawful and appropriate.
​
Provide safeguarding induction, code of conduct and clear boundaries before contact with children.
​
Keep suitability under review rather than treating checks as a one-off event.
​
Where a legal duty to refer to Disclosure Scotland is triggered by harmful behaviour and removal from a regulated role, make the referral.
​
Louise Robertson has completed NSPCC safeguarding and child protection training and acts as the Child Protection Lead.
​
5. Code of conduct for adults
​
Adults working with or helping at Scribbly & Still must:
Treat every child fairly, respectfully and with warmth, without favouritism.
​
Use age-appropriate, non-shaming language and respect communication differences and additional support needs.
Keep physical contact appropriate, child-led where possible, and connected to a clear need such as safety, comfort or an activity.
Never use corporal punishment, humiliation, threats, degrading language, sexualised language or behaviour.
​
Avoid being alone with a child where this can reasonably be avoided; use open, observable spaces and maintain appropriate supervision.
Never develop secretive or exclusive relationships with a child, give secret gifts, or ask a child to keep adult behaviour secret.
​
Do not communicate privately with children through personal social media, messaging or personal accounts.
​
Do not take or store photos/video of children on personal devices unless a documented, controlled arrangement specifically permits it.
Report any safeguarding concern, boundary breach, allegation or worrying adult behaviour immediately.
​
Challenge and report discriminatory, bullying, abusive, exploitative or unsafe behaviour.
​
6. Planning activities and keeping children safe
​
Every activity will be planned with safeguarding and practical safety in mind. This includes:
​
A proportionate written risk assessment for the venue and activity, reviewed when circumstances change.
​
Checking access, exits, fire arrangements, toilets, public access to the building, age-appropriateness of visible materials, equipment and hazards.
​
Appropriate supervision for the age, needs, activity and venue. A fixed ratio will not be used as a substitute for risk assessment.
​
Parent/carer consent and a registration form containing emergency contacts, collection arrangements, allergies, medical information and support needs relevant to safe participation.
​
Clear arrival and collection procedures. A child is released only to an authorised adult unless another arrangement has been agreed in advance.
​
A plan for first aid, emergencies, evacuation, missing child situations and contacting parents/carers.
​
Reasonable adjustments and inclusive practice so disabled and neurodivergent children can participate safely and with dignity.
​
7. One-to-one working, toileting and intimate care
​
Scribbly & Still activities are designed to avoid unnecessary one-to-one situations. If a child needs a private conversation, it should take place in an observable or interruptible space where possible.
​
Children will be encouraged to manage their own toileting. Routine intimate care is not normally provided. If a child has an identified care need, arrangements must be agreed with the parent/carer in advance, documented in a care plan where appropriate, and delivered with dignity, privacy and the least intrusive help necessary. Emergency help will be guided by the child’s immediate safety and dignity.
​
8. Photography, video, online safety and digital communication
​
Parents/carers will be told how images may be used and will be asked for appropriate permission before identifiable images are used for publicity or social media.
​
A child’s full name will not normally be published with an image.
Children will not be pressured to be photographed or filmed.
Images will be taken and stored only on approved business devices/accounts and deleted when no longer needed in line with the privacy/retention arrangements.
​
Any online activity involving children will use age-appropriate, moderated and privacy-conscious arrangements.
​
Inappropriate or harmful online content, contact or behaviour will be treated as a safeguarding concern and acted on accordingly.
​
9. Bullying, child-on-child abuse and harmful behaviour
​
Harm between children can be serious and must not be dismissed as 'banter' or an ordinary part of growing up. Concerns may include bullying, discriminatory abuse, physical assault, coercion, sexual harassment, harmful sexual behaviour, sharing sexual images, online abuse or exploitation.
​
Separate children and make the immediate situation safe.
Listen to each child without blame, interrogation or forcing an apology.
​
Record what happened and consider the needs and safety of all children involved.
​
Inform parents/carers when appropriate and safe.
​
Seek advice or refer to Social Work/Police where the behaviour may indicate abuse, exploitation, significant harm or criminal conduct.
​
Put proportionate measures in place to prevent recurrence and support affected children.
​
10. Recognising concerns
​
A concern may arise from something a child says, a change in behaviour, an injury, a parent/carer interaction, another adult’s behaviour, information from someone else, online activity, or a pattern of smaller concerns. Adults do not need proof before raising a concern.
​
Safeguarding concerns can include, but are not limited to:
physical abuse, emotional abuse, sexual abuse and neglect
domestic abuse and coercive control affecting a child
child sexual exploitation or criminal exploitation, trafficking or grooming, harmful sexual behaviour between children
online abuse, image-based abuse or unsafe contact
bullying, discriminatory abuse and hate-related harm
female genital mutilation (FGM), forced marriage and other harmful practices; radicalisation or extremist exploitation; serious mental health or self-harm concerns where a child’s safety may be at risk
unsafe adult behaviour, boundary violations or allegations against an adult
​
11. If a child tells you something: respond, do not investigate
​
The simple response: LISTEN - REASSURE - EXPLAIN - RECORD - REPORT
The adult’s job is to receive the information safely, not investigate it.
Listen calmly. Give the child time and take what they say seriously.
Use the child’s own words. Ask only enough open questions to understand whether immediate help is needed. Do not repeatedly question or ask leading questions.
​
Reassure the child that they did the right thing by telling you. Do not promise that everything will be fine.
​
Explain that you cannot keep a safety concern secret. Say you will share it only with people who need to help keep them safe.
If there is immediate danger or urgent medical need, call 999 and take reasonable steps to protect the child.
​
Make a factual written record as soon as possible, including date, time, place, who was present, the child’s words as accurately as possible, observations, questions asked and actions taken.
​
Report or refer without delay using Section 12 below. Do not confront the person alleged to have caused harm.
​
12. Reporting and referral procedure
​
Situation
Action
Who to contact
Immediate danger, serious injury, urgent threat, or crime in progress
Act immediately. Keep the child as safe as possible. Do not delay for internal consultation.
​
Police / ambulance: 999
​
Child protection concern in East Lothian
Share relevant information without delay. Follow advice given and record the referral and outcome.
East Lothian Children’s Services: 01875 824 309; cfdutyteam@eastlothian.gov.uk. Out of hours: 0800 731 6969. Police: 101 if not an emergency.
​
Child protection concern in City of Edinburgh
Share relevant information without delay. Follow advice given and record the referral and outcome.
Children and Families Social Work / Social Care Direct: 0131 200 2327. Police: 101 if not an emergency; 999 in an emergency.
​
Concern in another local authority area
Contact the child’s relevant local authority Children’s Social Work/Services or Police. Do not wait to find the 'perfect' contact if a child may be unsafe.
​
Relevant local authority / Police Scotland
​
Concern or allegation about Louise Robertson
Do not route the decision through Louise. Report directly to the relevant statutory agency. Preserve records/evidence and follow statutory advice.
​
Police / relevant local authority Social Work or Children’s Services
If uncertainty remains but the concern is about possible harm, advice should be sought from Social Work/Police. A lack of certainty is not a reason to leave a child at risk.
​
13. Information sharing and confidentiality
​
Safeguarding information is confidential, but confidentiality is not absolute. Where there is a child protection concern, relevant information may need to be shared with Police or Social Work without consent. Information sharing must be necessary, proportionate, timely, secure and lawful.
​
Do not ask for consent if the information will be shared regardless in order to protect a child.
​
Where safe and appropriate, explain to the child and parent/carer what will be shared, with whom and why.
​
Consider the child’s views, communication needs, age and understanding.
​
Share the minimum information needed for the safeguarding purpose.
​
Record what was shared, with whom, when, why, the lawful basis relied on, and whether the child/family were informed.
​
If a decision is made not to share a possible concern, record the reasons and the risks considered.
​
14. Recording, storage and access to records
​
Child protection records will be factual, dated, signed/attributed, securely stored and kept separate from ordinary class or marketing records as far as practicable. Access is limited to those who genuinely need it.
​
Record observations and the child’s words, not assumptions presented as fact.
​
Keep a clear chronology where there is more than one concern or incident.
​
Record decisions, referrals, advice received, follow-up actions and reasons.
​
Store digital records in a secured, access-controlled business system; paper records in a locked location.
​
Do not alter the original meaning of a record. If correcting something, keep the correction transparent and dated.
​
Respond to subject access or record-access requests in line with data protection law, taking advice where disclosure could affect a child’s or another person’s rights or a live safeguarding investigation.
​
Use a written retention schedule. Do not destroy child protection records simply because a child leaves an activity; set retention periods based on legal, insurance, and safeguarding requirements.
​
15. Parents, carers and children
​
Parents/carers will be told that Scribbly & Still has safeguarding and child protection procedures, who the Child Protection Lead is, how to raise a concern or complaint, how information may be shared, and where to find the child-friendly version.
​
Children will receive a simple explanation of their right to feel safe, who they can tell, what happens if they tell an adult something worrying, and that they will not be in trouble for asking for help.
​
16. GIRFEC: early wellbeing concerns
​
Not every wellbeing concern is a child protection concern. Where a child may benefit from support but there is no immediate child protection risk, Scribbly & Still will use a proportionate GIRFEC-informed approach: notice what is happening, listen to the child and family, consider strengths and needs across SHANARRI, and help connect the family to appropriate support where this is within the role and competence of the service.
​
The child and family should be at the heart of decisions and treated as partners.
​
Support should be rights-respecting, strengths-based, inclusive and proportionate.
​
Where appropriate, families may be signposted to the child’s named person or another relevant universal/service contact. Families are not obliged to accept named person support.
​
Scribbly & Still will not attempt to undertake a statutory child protection assessment or replace professional services.
​
If an early wellbeing concern becomes a child protection concern, the child protection reporting procedure applies immediately.
​
17. Additional support, disability and inclusion
​
Scribbly & Still recognises that some children may face additional barriers to being heard or may be at greater risk of harm. Communication methods may include visuals, play, drawing, gesture, assistive communication and extra processing time. Safeguarding decisions will not assume that a child’s behaviour, disability, neurodivergence or communication style explains away signs of harm.
​
18. Mental health and emotional wellbeing
​
Scribbly & Still promotes emotional expression and help-seeking. If a child appears distressed, talks about self-harm or suicide, or an adult is worried about their immediate safety, this will be treated seriously. Immediate risk requires emergency action; otherwise the concern will be shared with the parent/carer and/or appropriate services unless doing so could increase risk.
​
19. Complaints, concerns about practice and whistleblowing
​
Anyone may raise a safeguarding concern or complaint. A concern about child safety will be dealt with as a safeguarding matter even if it is also a complaint. No person should be disadvantaged for raising a genuine concern in good faith.
​
Concerns about ordinary practice can be raised with Louise Robertson.
​
Concerns about Louise, or concerns that cannot safely be raised with her, should be taken directly to Police, Social Work/Children’s Services, the venue/commissioning organisation where relevant, or another appropriate authority.
​
If a person believes a child remains at risk despite an earlier report, they should escalate the concern to Police or Social Work rather than assuming someone else has acted.
​
20. Allegations or concerns about an adult
​
Any allegation that an adult working with children has harmed a child, may have harmed a child, behaved in a way that indicates they may pose a risk, or seriously breached professional boundaries will be treated as a safeguarding matter.
​
Protect the child and address any immediate medical or safety need.
Do not investigate, confront the alleged person, or seek to obtain a detailed statement from the child.
​
Preserve messages, images, notes or other relevant evidence.
Contact Police/Social Work for advice and follow their direction.
Prevent further child contact where necessary and lawful while advice is sought.
​
Consider any required notification/referral to Disclosure Scotland, a commissioner, venue, insurer or other body after statutory advice.
Maintain confidentiality and share information only with those who need to know.
​
21. Missing child and uncollected child
​
If a child is missing during an activity:
Check the immediate area and attendance/collection information without leaving other children unsupervised.
Alert venue staff where relevant and contact the parent/carer.
Call Police promptly if the child cannot be located, the circumstances are suspicious, or there is any safety concern. Call 999 for immediate danger.
​
Record the incident and review how it happened.
​
If a child is not collected:
​
Keep the child supervised and reassured.
Try all authorised parent/carer and emergency contacts.
Do not take the child home or leave them with an unauthorised person.
​
If no responsible adult can be contacted within a reasonable period, seek advice from Social Work/Police and follow it.
Record actions and review collection arrangements.
​
22. Training, review and safeguarding audit
​
The Child Protection Lead will keep safeguarding training and knowledge current and refresh it at appropriate intervals.
The policy and procedures will be reviewed at least annually and after any significant incident, learning review, legal/guidance change, change in venue model or expansion of the workforce.
​
Risk assessments, registration/consent forms, photo permissions, record-keeping, complaints and safeguarding arrangements will be checked as part of the review.
​
Children’s and families’ feedback will be considered when reviewing whether safeguarding arrangements are understandable and working in practice.
​
23. Quick action card: I am worried about a child
​
1. Is anyone in immediate danger?
Yes: call 999. Take reasonable steps to make the child safe.
2. Listen and record
Stay calm. Do not investigate. Write the child’s words and the facts as soon as possible.
3. Share the concern
Contact the relevant Children’s Social Work/Services or Police without delay when there is a child protection concern.
4. If the concern is about Louise
Report directly to Police/Social Work. Do not rely on an internal route.
5. Keep a record
Record what you shared, with whom, when, why and what action/advice followed.
​
24. References and source guidance
​
Scottish Government, National Guidance for Child Protection in Scotland 2021 - updated 2023.
​
Scottish Government, Getting it right for every child (GIRFEC): policy statement and practice guidance, including SHANARRI and information sharing.
​
Scottish Government, Children and Young People (Scotland) Act 2014 - statutory guidance on assessment of wellbeing.
​
Scottish Government, UNCRC (Incorporation) (Scotland) Act 2024 guidance. The statutory duties in that Act primarily apply to defined public authorities; Scribbly & Still nevertheless adopts a child-rights-respecting approach.
​
Disclosure Scotland, current guidance on regulated roles, PVG scheme membership and duty to refer.
​
Edinburgh and the Lothians Multi-agency Child Protection Procedures.
East Lothian Council and City of Edinburgh Council child protection referral information.
​
NSPCC Learning, Safeguarding in voluntary and community groups action plan completed 10 September 2026.
25. Data protection and GDPR procedures
​
Scribbly & Still is a small data controller. It processes personal information about children, parents/carers, customers and contacts in order to run activities safely, manage bookings and payments, communicate, meet safeguarding responsibilities and operate the business. These procedures apply the UK GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and current ICO guidance.
26.1 What information we may hold
​
Child details: name, age/date of birth, attendance, authorised collectors and emergency contacts.
​
Safety and support information: allergies, medical information, disability/additional support needs, reasonable adjustments and relevant care information.
​
Parent/carer details: name, contact details, booking/payment and communication information.
​
Safeguarding records: concerns, disclosures, incident notes, referrals, advice and outcomes.
​
Images/video where permission and a clear purpose are in place.
Business administration records, enquiries, mailing-list preferences and complaints.
​
26.2 Data map and lawful basis
​
Before collecting personal information, Scribbly & Still will identify and record the purpose and lawful basis. Special category information (for example health data) also requires an Article 9 condition. The exact basis depends on the processing; the working data map in the operational toolkit must be kept up to date.
​
Processing
Procedure
​
Bookings and class administration
Usually necessary for contract and/or legitimate interests, depending on who the contract is with and the purpose.
​
Emergency and medical/support information
​
A suitable Article 6 basis plus an Article 9 condition must be recorded. Explicit consent may be appropriate for routine support information; vital interests may apply in a genuine emergency.
​
Safeguarding and child-protection information
​
A suitable Article 6 basis must be recorded. Where special category data is processed for safeguarding and consent cannot reasonably be relied on, the DPA 2018 Schedule 1 safeguarding condition may apply and an Appropriate Policy Document is required.
​
Marketing emails
​
Consent or another lawful route permitted by PECR/UK GDPR. Marketing choices must be separate from participation in a class.
​
Photos and video for publicity
​
Use only with a documented lawful basis and clear permission arrangements; participation must not depend on agreeing to publicity images.
26.3 Privacy information
​
Give parents/carers privacy information when collecting their data.
Give children privacy information in clear, age-appropriate language where their information is collected or used.
​
Explain what is collected, why, lawful basis, who it may be shared with, how long it is kept, rights and how to complain.
​
If personal information is obtained from another source, provide privacy information within the legal timeframe unless an exemption applies.
​
Review privacy information when uses, systems or suppliers change.
​
26.4 Data minimisation and access
​
Do not collect information simply because it might be useful later.
Separate routine class information from safeguarding records as far as practicable.
​
Use strong passwords and multi-factor authentication where available.
​
Restrict access to sensitive records to the people who genuinely need it.
​
Do not keep children’s records in personal messaging apps, personal social-media accounts or unapproved devices.
​
Before using a new booking, form, cloud or AI service, check what data it receives, where it is stored, retention, security and contractual/data-processing terms.
​
26.5 Retention and deletion
​
Scribbly & Still will use a written retention schedule. Routine records must not be kept indefinitely. Safeguarding records require longer and more cautious retention because they may be needed to protect a child or evidence decisions. Deletion must include duplicate copies and downloads where practicable, subject to legal, insurance and safeguarding needs.
​
26.6 Individual rights and requests
​
Recognise any request about personal data, even if the person does not use the words “subject access request”.
​
Record the date received and verify identity proportionately where needed.
​
Clarify the request only if necessary; do not make the person repeat information already provided.
​
Carry out reasonable and proportionate searches.
​
Respond within the applicable statutory timeframe, normally no later than one calendar month for a rights request, subject to lawful extensions/exceptions.
​
Before releasing a child’s information to a parent/carer or another person, consider the child’s own rights, capacity, confidentiality, third-party information and safeguarding risk.
​
Keep a record of the request, searches, decision and response.
​
26.7 Personal data breach procedure
​
Contain the breach: recover information, revoke links, change passwords, contact the unintended recipient, or isolate a compromised device/account as appropriate.
​
Start a breach log immediately and record when the breach was discovered.
​
Assess what data is affected, whose data, the likely consequences and risk to people - giving particular weight to children and safeguarding information.
​
If the breach is likely to risk people’s rights and freedoms, report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware.
​
If the breach is likely to create a high risk to people, tell affected people without undue delay unless a lawful exception applies.
​
Record every breach and the reasons for reporting or not reporting it, then review controls to prevent recurrence.
​
26.8 Data protection complaints
​
Provide a clear route for a person to make a data protection complaint, including electronically.
​
Acknowledge the complaint within 30 days.
​
Investigate appropriately and without undue delay, keeping the person informed where necessary.
​
Explain the outcome without undue delay and tell them they can complain to the ICO if dissatisfied.
​
Keep a record of the complaint, investigation, outcome and any corrective action.
​
26.9 Data protection impact assessments and new systems
​
Before starting processing that is likely to be high risk, Scribbly & Still will complete a Data Protection Impact Assessment (DPIA). A DPIA should also be considered when introducing new technology or systematic processing involving children, sensitive information, monitoring, profiling or large-scale data use. If the activity cannot be made acceptably safe, it will not proceed without appropriate specialist advice.
​
26.10 ICO fee and accountability
​
Use the ICO data-protection fee self-assessment and pay/register if required; sole traders can be liable unless an exemption applies.
Maintain a proportionate record of processing activities because Scribbly & Still carries out regular processing and handles special category/safeguarding data.
​
Keep this policy, the data map, retention schedule, breach log, consent records, processor/supplier checks and Appropriate Policy Document under review.
​
26.11 Appropriate Policy Document - safeguarding and special category data
​
Where Scribbly & Still relies on a DPA 2018 Schedule 1 condition that requires an Appropriate Policy Document, it will maintain the separate document in the operational toolkit. That document records the relevant condition, compliance with the data-protection principles and retention/deletion arrangements.
​
26.12 Children and online services
If Scribbly & Still later provides an online service likely to be accessed by children, it will assess whether the ICO Children’s Code applies and build high-privacy, child-centred safeguards into the service from the start. The current real-world classes and an informational website do not automatically make every part of the Children’s Code applicable; any new online child-facing service must be assessed before launch.