What Should a Safeguarding Policy Include? A Guide for Schools, Charities and Clubs
A safeguarding policy is the written statement of how an organisation protects children and adults at risk, who is responsible, and what everyone must do if they have a concern. In England, early years providers must have written safeguarding policies, schools and colleges must have regard to statutory guidance that says they should have a child protection policy, and charities, clubs and out-of-school groups are expected to have one. A good policy names a safeguarding lead, explains how to report, and is reviewed at least once a year.
On this page
- 1What is a safeguarding policy, and who is required to have one?
- 2What should a school or college in England include in its child protection policy?
- 3What do early years settings, clubs and out-of-school providers need in a safeguarding policy?
- 4What do charities and trustees need to have in place?
- 5What should a safeguarding policy cover when adults at risk are involved?
- 6What should be in a safeguarding policy? A section-by-section list
- 7What is the difference between a policy, a procedure, a code of conduct and a risk assessment?
- 8How do you write a safeguarding policy in practice?
- 9How often should a safeguarding policy be reviewed?
- 10What mistakes do organisations make with safeguarding policies?
- 11How do inspectors and regulators check a safeguarding policy?
- 12What is different in Scotland, Wales and Northern Ireland?
- 13Which training helps people understand and follow a safeguarding policy?
- 14What is a quick checklist for your safeguarding policy?
- 15Frequently asked questions
- What it is. A safeguarding policy states how an organisation protects people, who is responsible and what to do about a concern, backed by detailed procedures staff can follow.
- Who needs one. Early years providers face legal duties, schools must have regard to statutory guidance that says they should have one, and charities, clubs and out-of-school groups are expected to.
- What it should cover. A named lead, how to report concerns and allegations, staff conduct, online safety and images, training, and correct local contacts.
- Keep it live. Review it at least once a year and after any serious incident, make it public where required, and train everyone. Awareness courses do not replace your policy.
This guide is for head teachers, governors, trustees, club coordinators and anyone asked to write or update a policy. It covers England, checked on 30 October 2026, with a short section on Scotland, Wales and Northern Ireland. Headings we suggest for your own policy are good practice, not law. For the wider picture, see our guides to safeguarding children and safeguarding adults. General information, not legal advice.
What is a safeguarding policy, and who is required to have one?
NSPCC Learning splits the job in two. A policy statement is short and makes clear what the organisation will do to keep children safe. Procedures are the detailed guidelines and instructions that support it and tell staff and volunteers what to do. Many organisations combine the two, and schools usually call the result a child protection policy. NSPCC Learning advises keeping policies for children separate from those for adults aged 18 and over.
The legal position depends on what sort of organisation you are. We did not find one law that requires every organisation in the UK to hold a written safeguarding policy, so find the row below that matches you. The table covers England unless it says otherwise.
| Type of organisation | What the source says | Source |
|---|---|---|
| Schools and colleges | Must have regard to statutory guidance. Governing bodies and proprietors should ensure an effective child protection policy that is reviewed at least annually and made public. | Keeping Children Safe in Education 2026 (KCSIE), paragraphs 122 to 124 |
| Early years providers (nurseries, pre-schools, school-based early years) | Must have and implement written policies and procedures to keep children safe, including safeguarding policies with set content. | early years foundation stage (EYFS) statutory framework, paragraphs 3.5 and 3.6 (group and school-based version, effective 1 September 2026) |
| After-school clubs, tuition, youth clubs, uniformed and sports groups | Should have a written safeguarding and child protection policy and review it annually and after any incident. | Out-of-school settings: safeguarding guidance for providers (DfE, February 2026) |
| Voluntary, community, faith-based and private organisations working with children | Should have policies in place to safeguard and protect children from harm, and systems to check they are followed. | Working Together to Safeguard Children 2026, paragraph 358 |
| Charities (England and Wales) | Trustees must take reasonable steps to protect people who come into contact with the charity, and are expected to make sure it has appropriate policies and procedures that everyone follows. | Charity Commission, Safeguarding and protecting people for charities and trustees |
| Any organisation working with adults at risk | There should be adult safeguarding policies and procedures. Employers must ensure staff, including volunteers, are trained to recognise and respond to abuse or neglect. | Care and Support Statutory Guidance, chapter 14, paragraphs 14.52 and 14.102 |
| Care providers registered with CQC | Must establish and operate systems and processes to prevent abuse and to investigate any allegation or evidence of it immediately. | Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 13 |
Notice the verbs. In KCSIE, “must” means the person is legally required to do something and “should” means the advice should be followed unless there is good reason not to. Funding, hire and insurance agreements can add conditions: KCSIE says a school hiring out its premises should seek assurance that the hirer has appropriate safeguarding and child protection policies (paragraph 209).
What should a school or college in England include in its child protection policy?
Keeping Children Safe in Education 2026 is statutory guidance issued under section 175 of the Education Act 2002 and related regulations. It came into force on 1 September 2026, and schools and colleges must have regard to it. For independent schools, the Education (Independent School Standards) Regulations 2014 (Schedule, paragraph 7) require the proprietor to make arrangements to safeguard and promote pupils’ welfare that have regard to guidance from the Secretary of State.
Paragraph 123 says governing bodies and proprietors should ensure the school or college has an effective child protection policy which:
- reflects the whole school or college approach to child-on-child abuse (paragraphs 192 and 193 and Part five),
- reflects the reporting systems that let children report abuse or neglect confidently (paragraph 121),
- describes procedures in accordance with government guidance,
- refers to the locally agreed multi-agency safeguarding arrangements set by the safeguarding partners (paragraphs 132 to 139),
- includes policies reflected elsewhere in Part two, such as online safety (paragraphs 164 to 169) and special educational needs and disabilities (paragraphs 249 to 251),
- is reviewed annually as a minimum and updated if needed, and
- is available publicly, either on the website or by other means.
The same paragraph also expects a behaviour policy, a staff behaviour policy (the code of conduct, which should cover low-level concerns, allegations against staff and whistleblowing) and arrangements for children absent from education. Paragraph 124 says the list is not exhaustive. The 2026 summary of changes says the list of factors a school’s child protection policy should include was updated, so a policy last rewritten for 2025 needs checking. See our guides to child-on-child abuse, low-level concerns and KCSIE.
Governing bodies and proprietors have strategic leadership responsibility for safeguarding (paragraph 84) and should have a senior board-level lead (paragraph 86). They should appoint a senior member of the leadership team as the designated safeguarding lead (DSL), explicit in the job description, and the proprietor should not be the DSL (paragraph 127). The 2026 guidance adds an expectation of robust cover when the DSL is unavailable (paragraph 129), and any deputy DSL should be trained to the same standard (paragraph 130).
Staff must be able to find the policy. It should be given to all staff at induction with Part one and the DSL’s identity (paragraphs 11 and 124), and the DSL should ensure each member of staff understands it (Annex B). Schools should also give applicants a copy in the application pack or link to it on the website (paragraph 293).
What do early years settings, clubs and out-of-school providers need in a safeguarding policy?
Early years. Section 3 of the EYFS framework says every setting must designate a practitioner to lead on safeguarding (paragraph 3.4) and must have and implement written policies and procedures that follow the guidance of the local safeguarding partners (paragraph 3.5). Paragraph 3.6 says safeguarding policies must include:
- the action to be taken when there are safeguarding concerns about a child,
- the action to be taken if an allegation is made against a member of staff,
- how mobile phones, cameras and other devices that can capture and share images are used in the setting,
- the procedures for checking that new recruits are suitable, and
- details of how safeguarding training is delivered and how practitioners are supported to put it into practice.
Paragraph 3.7 adds whistleblowing procedures for all staff, including students and volunteers. Childminders follow a separate version of the framework, so check that one if it applies to you.
After-school clubs, youth groups, tuition and sports clubs. The DfE’s out-of-school settings guidance (February 2026) says all providers should have a written safeguarding and child protection policy, with written procedures if they have staff or volunteers. It says the policy should be tailored to your organisation and reviewed annually and after any incident. As a minimum it should include:
- a short policy statement on the priority you give to keeping children safe and how you will achieve it,
- a commitment that no staff member or volunteer should inflict physical or psychological harm on a child,
- the procedures that keep children safe,
- the DSL’s details and how to contact them,
- contact details for any governing body or association, and
- contact details for the local authority children’s social care team, the local authority designated officer (LADO) and the police.
Typical written procedures, it says, cover concerns that a child has been abused or exploited, child-on-child abuse, an adult who may pose a risk, adults trespassing for the purposes of abuse, and complaints. It also lists a code of conduct and a whistleblowing policy. The guidance was written with reference to England.
Sport. Working Together to Safeguard Children 2026 says all sports clubs and organisations, including community amateur sports clubs and charities, should have the arrangements its chapter describes (paragraph 360), and that national governing bodies funded by Sport England or UK Sport should aim to meet the Standards for Safeguarding and Protecting Children in Sport (paragraph 361). Those Standards for safeguarding and protecting children in sport, from NSPCC Sport (formerly the Child Protection in Sport Unit), were revised in 2018, and the first of their ten standards is policy and procedures for responding to concerns. For DBS checks, see safer recruitment.
What do charities and trustees need to have in place?
The Charity Commission’s guidance for England and Wales (last updated 8 October 2026) says safeguarding should be a governance priority. Trustees must take reasonable steps to protect people who come into contact with the charity: beneficiaries, staff, volunteers and others. The Commission is not a safeguarding authority and does not investigate individual allegations, but it can check whether trustees followed the guidance and the law.
It says a charity’s policies and procedures should be put into practice, reviewed as necessary, always after a serious incident and at least once a year, and available to the public. They should make clear how the charity will protect people from harm, make sure people can raise concerns, handle allegations or incidents, and report to the relevant authorities. The detail depends on what the charity does, where it works, whether it operates online and the level of risk. It also expects a code of conduct, whistleblowing arrangements, a complaints process and a regularly reviewed risk register.
Charities working with children or adults at risk should also have policies that fit those of the local safeguarding partnership or board, train staff and volunteers regularly and appoint a safeguarding lead. In some cases trustees must send a serious incident report to the Commission. Its How to report a serious incident in your charity guidance (updated 16 January 2026) defines a serious incident as an adverse event, actual or alleged, that results in or risks significant harm to people who come into contact with the charity, among other things. See also our charity training requirements guide.
One change to watch: the Commission’s page says that from 1 September 2026 the supervision exemption for regulated work with children no longer applies, so some supervised staff and volunteers may now be doing regulated activity, and trustees should review affected roles and DBS arrangements. The Government’s announcement has the detail, and our safer recruitment guide covers checks in general.
What should a safeguarding policy cover when adults at risk are involved?
Chapter 14 of the Care and Support Statutory Guidance (page last updated 22 July 2025) says that in any organisation there should be adult safeguarding policies and procedures that reflect the statutory guidance (paragraph 14.52). Procedures may include a statement of purpose, a statement of roles and accountability, the procedure for allegations of abuse (including emergencies and reporting to the police), a full list of referral points including out of hours, how to record allegations and actions, sources of expert advice, information sharing between agencies, and how professional disagreements are resolved.
Paragraph 14.102 says employers must ensure staff, including volunteers, are trained to recognise abuse or neglect, how to respond and where to go for advice, and that this is best written down in shared policy documents. Paragraph 14.120 says providers of universal care and support services should have clear policies for allegations against people who work with adults, distinguishing an allegation, a concern about quality of care and a complaint. For care providers, see safeguarding in home care, safeguarding adults and Making Safeguarding Personal.
What should be in a safeguarding policy? A section-by-section list
The headings below are our suggested good practice, built from the sources above. They are not a legal template, so adapt them to your sector, your nation and your risks. Where a source names the item, we say so.
| # | Section | What to put in it (suggested good practice) | Source pointers |
|---|---|---|---|
| 1 | Purpose, scope and values | Who the organisation is; who the policy covers (staff, volunteers, trustees, contractors; children under 18, adults at risk or both); an equality commitment. Decide whether occasional-contact roles such as a caretaker are covered. | NSPCC Learning |
| 2 | Legal and guidance framework | The main laws and guidance for your sector and nation, and a reference to the local safeguarding partnership or board procedures. | KCSIE para 123; Charity Commission |
| 3 | Roles and responsibilities | Named DSL, deputies and cover; the governor or trustee lead; the head or manager; duties of every member of staff and volunteer. | KCSIE paras 86, 127 to 130; DfE out-of-school guidance |
| 4 | Definitions and categories of abuse | What abuse and neglect mean for the people you work with. See types of child abuse. | KCSIE Part one; Care Act guidance ch. 14 |
| 5 | Recognising concerns | Signs, child-on-child abuse, exploitation, online harm and risks outside the home. See contextual safeguarding. | KCSIE paras 192 to 193 |
| 6 | How to report | Internal route first; 999 if someone is in immediate danger; then children’s social care or adult safeguarding, the LADO for allegations about adults who work with children, and the police where a crime may have happened. Insert real local and out-of-hours numbers. See the child protection conference guide for what can follow a referral. | KCSIE para 123; OOSS guidance; Care Act para 14.52 |
| 7 | Responding to a disclosure | Listen, never promise secrecy, explain that you must share it with someone who can help, and do not investigate yourself. | NSPCC Learning |
| 8 | Recording and confidentiality | What to record, who records it, where it is stored and who may see it. Share only with people who need to know, and share concerns about a child even if they ask you not to. | NSPCC Learning |
| 9 | Safer recruitment | Identity, references and DBS where eligible, and how volunteers are vetted. See safer recruitment. | EYFS para 3.6; Charity Commission |
| 10 | Training | Induction and refresher training for each role. See safeguarding training requirements. | KCSIE para 12 and Annex B; EYFS para 3.6 |
| 11 | Code of conduct | Expected behaviour, relationships and communication with children, technology and social media, and avoiding working alone with a child where possible. | KCSIE para 123; OOSS guidance |
| 12 | Allegations and low-level concerns | Who receives an allegation, how the LADO or equivalent is involved, and how low-level concerns are handled. | KCSIE Part four; EYFS para 3.6; WT para 264 |
| 13 | Whistleblowing | How anyone can raise unsafe practice, and the outside routes if they cannot raise it internally. | EYFS para 3.7; OOSS guidance |
| 14 | Online safety and images | Filtering and monitoring where relevant, acceptable use, mobile phones and cameras, and taking and sharing photographs. | KCSIE para 169; EYFS para 3.6 |
| 15 | Children’s and adults’ voice | How children and adults can report concerns and be heard. | KCSIE paras 120 to 121 |
| 16 | Working with partners | Information sharing, early help, hirers and contractors, and links with safeguarding partners. | KCSIE paras 132 to 139 and 208 to 209 |
| 17 | Complaints | How children, families and adults can complain, and how that differs from a safeguarding report. | OOSS guidance |
| 18 | Approval, version and review date | Who approved it, when it takes effect and the next review date; ideally signed by the most senior person responsible for safeguarding. | KCSIE para 123; NSPCC Learning |
Keep it readable. NSPCC Learning suggests aiming for about two sides of A4 for the policy statement itself, with the detail in separate procedures.
What is the difference between a policy, a procedure, a code of conduct and a risk assessment?
These documents work together. The table is our summary of how the sources use each term.
| Document | What it does | Example |
|---|---|---|
| Safeguarding or child protection policy | States the organisation’s commitment, who is responsible and the broad approach. NSPCC Learning aims for about two sides of A4 for a policy statement. | “We will appoint a named lead and train all staff.” |
| Procedures | Give the detailed steps to follow and are what staff use in the moment. NSPCC Learning says each should state its aim, who it applies to, clear steps, what to record and who to contact. | Steps for responding to a disclosure, or for handling an allegation about a volunteer |
| Code of conduct (staff behaviour policy) | Sets expected behaviour. KCSIE says it should include low-level concerns, allegations, whistleblowing and acceptable use of technology. | Rules on phone contact with children, gifts and social media |
| Risk assessment (and risk register) | Identifies what could go wrong and how it is controlled. The Charity Commission expects a risk register that is regularly reviewed. | A review of a trip, a venue or an online session |
The policy should refer to the others by name, and each should have its own owner and review date.
How do you write a safeguarding policy in practice?
- Work out what applies. Use the table above to identify your sector, your nation and any funder or hirer requirements.
- Name the people. Appoint the lead and a deputy first, and agree who the governor, trustee or committee lead is.
- List your risks. NSPCC Learning suggests asking what risks children face, who may pose a risk, how someone might raise a concern and how you check people are suitable.
- Start from a reliable source and tailor it. Use your local safeguarding partnership or sector body. The Charity Commission says to use only templates appropriate for your charity.
- Add and test local detail. Insert the real names, numbers and referral routes and check each one works.
- Consult. Ask staff, volunteers and, where suitable, children and families what is unclear.
- Get approval. Governors, proprietors, trustees or the committee should approve it: KCSIE puts responsibility for policies on governing bodies and proprietors (paragraph 122), and the Charity Commission puts it on trustees.
- Publish, communicate and train. Make it public where required, give it to new staff at induction and train everyone on it, because a policy nobody has read protects nobody.
- Diarise the review. Set the next review date and the events that would trigger an earlier one.
How often should a safeguarding policy be reviewed?
At least once a year in every source we checked. KCSIE says a school’s child protection policy should be reviewed annually as a minimum. The Charity Commission says as necessary, always after a serious incident and at least once a year. NSPCC Learning says typically at least once a year or when significant changes or a local incident show a review is needed, and the DfE’s out-of-school guidance says annually and after any incident.
Treat these as triggers for an earlier review too: a new edition of statutory guidance (KCSIE 2026 took effect on 1 September 2026), a change of DSL or trustee lead, new local procedures, a serious incident or near miss, and new activities such as online sessions. In Wales, Care Inspectorate Wales said on 10 July 2026 that providers should review their procedures against the revised Section 5 of the Wales Safeguarding Procedures. Keep a short log of each review.
What mistakes do organisations make with safeguarding policies?
- Copy and paste. A policy lifted from another organisation names their lead, local authority and activities. NSPCC Learning says to tailor it.
- Wrong or out-of-date local contacts. Referral numbers, LADO details and out-of-hours routes change. Check them whenever you review.
- Out-of-date KCSIE references. KCSIE 2026 removed the former Annex A (the condensed Part one), and the annex letters changed: Annex A is now Further information and Annex B is the role of the DSL. A policy that points to an “Annex A” or an old paragraph number from an earlier edition may now send staff to the wrong place.
- No named DSL, deputy or cover. Paragraphs 127 to 130 expect a DSL, deputies and cover arrangements, and the policy should say who they are.
- No allegations procedure. Early years providers must cover allegations against staff, and KCSIE Part four expects schools to have their own procedures.
- Never reviewed. A review date two years in the past tells an inspector that nobody is checking.
- Not communicated. A policy on a shared drive does not meet the expectation that every member of staff has access to it and understands it.
How do inspectors and regulators check a safeguarding policy?
In England, Ofsted’s state-funded school inspection toolkit (updated June 2026, for use on inspections from 7 September 2026) judges safeguarding as met or not met, not on the five-point scale used for other areas. Inspectors evaluate whether leaders ensure staff know and uphold their safeguarding responsibilities, are assured that policies are understood and applied, and have policies for reporting concerns about adults, poor practice and whistleblowing. The standards were developed from KCSIE and Working Together. Independent schools are inspected against the Independent School Standards, by the Independent Schools Inspectorate or by Ofsted depending on the school’s type.
Registered early years providers must tell Ofsted, or their childminder agency, of any allegations of harm or abuse by anyone living, working or looking after children there (EYFS paragraph 3.10). The Charity Commission can check whether trustees followed its guidance and the law, and CQC regulates registered care providers against regulation 13. Expect to show evidence that the policy works, such as training records and review dates, not only the document.
What is different in Scotland, Wales and Northern Ireland?
This guide is mainly about England. Each nation has its own framework, so follow your local procedures. The table points to the sources we checked.
| Nation | Where to look | What to know |
|---|---|---|
| Scotland | National Guidance for Child Protection in Scotland 2021 (updated 2023); OSCR safeguarding guidance; Adult Support and Protection (Scotland) Act 2007 | The national child protection guidance was published on 31 August 2023 in its current form. OSCR, the Scottish charity regulator, publishes safeguarding guidance for charity trustees (published April 2025, updated August 2025) that points to Disclosure Scotland for the Protecting Vulnerable Groups (PVG) scheme. |
| Wales | Wales Safeguarding Procedures; Keeping learners safe | The Wales Safeguarding Procedures cover children, adults at risk and safeguarding allegations (Section 5). Care Inspectorate Wales announced revised Section 5 procedures on 10 July 2026. Keeping learners safe is Welsh Government guidance for local authorities and governing bodies on schools. |
| Northern Ireland | Safeguarding Board for Northern Ireland (SBNI) Procedures Manual; Charity Commission for Northern Ireland: safeguarding | The SBNI manual holds the regional core child protection policy and procedures (shown as last updated 13 March 2025). The Charity Commission for Northern Ireland points organisations to Volunteer Now’s standards and a nine-standard checklist for an overarching safeguarding policy. |
Which training helps people understand and follow a safeguarding policy?
Three Nexis CPD courses build the knowledge behind the sections above:
Together they cost £18 rather than £27 under the pay-for-2-get-3 offer, and employers training 5 or more staff pay £6 a course place on the team plan. These are awareness-level CPD courses, not regulated qualifications, and they do not replace your own safeguarding policy, local multi-agency procedures or specialist training. If you take one, start with Safeguarding Children (Advanced) Level 2: 20 questions, 80% to pass, and an instant certificate.
Safeguarding Children (Advanced) Level 2
100% online, at your own pace. Pass the assessment and your verifiable certificate is emailed instantly.
What is a quick checklist for your safeguarding policy?
These questions are our suggestions for a quick check, not a legal form.
- Does it say which laws and guidance apply to us?
- Does it name the DSL, deputy and governor or trustee lead, with cover?
- Are the referral routes, LADO and out-of-hours numbers correct today?
- Does it cover child-on-child abuse, online safety, images and devices where relevant?
- Is there a procedure for allegations and low-level concerns, and a whistleblowing route?
- Does it say how concerns are recorded, stored and kept confidential?
- Has it been approved and dated, and does every member of staff and volunteer have it?
- Is the next review date set?
Frequently asked questions
Is a safeguarding policy a legal requirement?
It depends on the organisation. Early years providers must have written safeguarding policies. Schools and colleges must have regard to statutory guidance that says they should have a child protection policy. Charities, clubs and out-of-school groups are expected to have one by regulators and government guidance.
Is a safeguarding policy the same as a child protection policy?
In the sources we checked there is no fixed legal difference. KCSIE says child protection policy, and the DfE’s out-of-school guidance says safeguarding and child protection policy. Use the name your guidance uses.
How often should a safeguarding policy be reviewed?
At least once a year. KCSIE, the Charity Commission, NSPCC Learning and the DfE’s out-of-school guidance all say so, and the Charity Commission adds that charities should always review after a serious incident.
Do small clubs and volunteer groups need a written policy?
The DfE’s out-of-school guidance says all providers should have a written safeguarding and child protection policy, with written procedures if they have staff or volunteers. A lone provider need not write every step down but should know what they would do.
Can we copy a template from another organisation?
Use a template as a starting point only. NSPCC Learning says to tailor your policy to your organisation, and the Charity Commission says to use only templates that are appropriate for your charity. Add your own lead, local contacts and activities.
Does an awareness course replace our own safeguarding policy?
No. Awareness CPD is not a regulated qualification. It helps people recognise and report concerns, but you still need your own policy, local multi-agency procedures and any specialist training your role requires.
General information, not legal advice. If a child or adult is in immediate danger, call 999. This guide reflects Keeping Children Safe in Education 2026, Working Together to Safeguard Children 2026, the EYFS statutory framework effective 1 September 2026, the DfE out-of-school settings guidance (February 2026), Charity Commission guidance (updated 8 October 2026), the Care and Support Statutory Guidance (page last updated 22 July 2025) and the other sources named above, checked on 30 October 2026. Arrangements differ in Scotland, Wales and Northern Ireland, and each organisation and local safeguarding partnership sets its own procedures. Nexis CPD courses are CPD-accredited awareness training, not regulated qualifications, and they do not replace your organisation’s safeguarding policy, local multi-agency procedures or specialist training.