Nurseries hold some of the most sensitive data in the country. Every day, settings work with information that directly relates to children’s safety, wellbeing, health, and family circumstances. Much of this now sits inside Microsoft 365, whether that’s digital learning journals, safeguarding notes, accident forms, parental consents, or medication records.

And although Microsoft gives you helpful recovery features, these are not a substitute for a true backup.

This matters because Ofsted and UK GDPR all require you to keep records safe, accurate and accessible when needed. A single deletion, account breach or ransomware attack risks far more than lost files – it can impact safeguarding, compliance and trust with families.

What Microsoft 365 does give you

Useful features include:

• Version history – helpful if you need to undo edits
• Recycle bins – up to 93 days of recovery
• Retention labels/policies – optional but often not configured
• Geo-redundancy – protection against Microsoft’s own datacentre failure

These are “data resilience” tools, not backups. They fail in three common situations:

Where nurseries are still exposed

Permanent deletion

Once an item passes the recycle-bin limit or a retention rule moves it on, it’s gone.

Ransomware or account compromise

If an attacker encrypts, corrupts or mass-deletes data, Microsoft sees this as a customer-side event. You need your own off-platform backup to recover clean copies.

Misconfigured retention settings

Many settings don’t have retention policies turned on or don’t know they need them. Ofsted expects records to be complete and retrievable – a misconfigured tenancy puts that at risk.

What regulators expect from nurseries

Backup isn’t explicitly named in every standard, but the obligation to protect, retain and restore data absolutely is.

Here’s how it maps:

EYFS Requirements (Statutory Framework)

EYFS requires providers to:

Maintain records securely
Ensure they are easily accessible and available to those who need them
Protect sensitive information relating to children and families
Retain certain records for required periods

If a cyber incident wipes medication logs, safeguarding notes, or attendance data, you cannot meet these duties.

Ofsted Expectations

Ofsted inspections consider:

• How safeguarding information is stored
• Whether records are complete, accurate and accessible
• How leaders ensure data is protected
• Whether digital systems are managed safely
• How quickly information can be accessed during an incident

If data disappears because a Microsoft account was compromised or deleted, inspectors may judge leadership and management as ineffective.

UK GDPR / Data Protection Act 2018

Backups directly support:

Article 5(1)(f) – integrity and confidentiality
Data must be protected from loss, destruction or damage.

Article 32 – security of processing
You must ensure the “availability and resilience” of your systems – meaning you must be able to restore data quickly.

Article 24 – accountability
You must show evidence of how you protect data.

A ransomware attack with no backup = breach.

Why backups matter for real nursery scenarios

Here are the situations where we’ve seen nurseries struggle:

• A staff member deletes a folder thinking it’s old
• A former employee’s account was removed incorrectly
• A supplier triggers a sync that overwrites files
• Retention labels weren’t configured
• A ransomware email got through an old spam filter
• A OneDrive install corrupted during a laptop refresh

Microsoft 365 alone can’t help in these situations.
A proper backup can.

What good looks like

A nursery-appropriate backup solution should include:

• Automatic daily backups of SharePoint, OneDrive, Teams, Email
• Point-in-time restore going back months or years
• Unlimited retention (ideal for sensitive records)
• Independent, off-platform storage
• Secure access controls
• Fast restoration with audit evidence

This gives leaders confidence and it gives Ofsted clear assurance you can protect children’s data.

Your nursery’s digital records are part of your safeguarding practice. They deserve the same care you give to the physical safety of children.

A proper backup isn’t just “good IT”.
It’s your insurance against losing vital information families and regulators expect you to protect.

If you’d like any further information, please complete the form below: