Privacy and Data Protection When Keeping Records

Recording your own progress—your reflections, warning signs, actions and learning—is legitimate. Recording another person’s activities, location, messages or relationships is monitoring, and can be a form of abuse.

Keep the distinction clear. Your records should be about you, not about someone else.

Keep only what you need. Do not collect or store information about another person “just in case”. The principle of data minimisation means holding the minimum necessary for a legitimate purpose.

If a record is not serving your own change or a legal requirement, do not keep it.

Store records securely—protected by a strong password, on a device you control, not shared or publicly accessible. Limit access to yourself and, where relevant, your solicitor or support professional.

Do not store sensitive records on shared family devices or in accounts others can access.

Be especially careful with information about children. Store the minimum necessary, keep it secure, and never share it publicly or with people not entitled to it. Children’s privacy is a safeguarding matter.

Do not record or retain information about a child that serves no legitimate purpose.

Court documents, social-care records and professional reports are often confidential and subject to rules about how they may be used and shared. Follow those rules. Do not publish, circulate or misuse them.

Sharing family-court documents improperly can be a contempt of court. Keep them secure and use them only for their intended purpose.

Do not retain, share or publish private images or messages of another person, particularly intimate images. Sharing intimate images without agreement can be a criminal offence.

If you hold such material, seek advice from a solicitor about lawful handling. Do not keep it to use as leverage.

Never share records about another person, a child, or court proceedings publicly—including on social media, in forums, or with people not involved. Public sharing can be unlawful, harmful, and a safeguarding issue.

Your own reflections are yours to share cautiously; other people’s information is not yours to share at all.

Where you lawfully need to share a document, redact information about people not relevant to the purpose—especially children and third parties. Redaction protects privacy and is often expected by professionals and the court.

Ensure redaction is complete and irreversible, not just a visual cover that can be removed.

Do not keep records longer than necessary. Once a record no longer serves a legitimate purpose and is not required for legal proceedings, dispose of it securely—permanently deleting files, not just moving them to a recycle bin.

Some records must be preserved for legal proceedings or safeguarding; do not destroy those. When in doubt, seek legal advice before disposing of anything.

If you want information held about you by an organisation, use a subject access request through the organisation’s official process. Do not attempt to access accounts, systems or devices to obtain it yourself.

Unauthorised access to another person’s data or accounts can be a criminal offence.

Keep your own records accurate. If you are recording facts relevant to legal proceedings, preserve originals and do not alter them. Accuracy protects your credibility; alteration destroys it.

Distinguish clearly between factual records and your own reflections or opinions.

In the UK, personal data is governed by the UK GDPR and the Data Protection Act 2018. In general terms, these require that personal data is processed lawfully, fairly, and transparently, kept secure, and not kept longer than necessary.

This article is general information, not legal advice. The Information Commissioner’s Office (ICO) provides detailed guidance on your obligations and rights.

If you have organisational or professional responsibilities for data, seek specific advice from a qualified professional or your organisation’s data protection lead. Organisational obligations are more extensive than personal record-keeping.

This article does not cover organisational compliance, which depends on your role and context.