Walk into almost any early learning service and you will find educators using their own phones to photograph children. Not carelessly — the opposite. They are documenting learning, capturing a moment for a family, recording an observation for a portfolio. The intention is good, the practice is normal, and the exposure it creates is one most services have never fully thought through.
This is not a story about bad staff. It is a story about a gap between what a service is responsible for and what it can actually see.
What the service cannot see
Once an image of a child exists on an educator's personal phone, the service has lost control of it in every practical sense.
- It syncs automatically to whatever cloud account the phone is signed into — Apple, Google, sometimes both — under the educator's personal login.
- It persists after the educator leaves. Services routinely have no idea how many former staff still hold images of current and past children.
- It is backed up, shared, and copied by processes the service has no visibility of and no ability to interrupt.
- If the phone is lost, stolen or accessed by someone else in the household, the images go with it.
- If a parent, a regulator or a court asks the service to confirm what images of a particular child exist and who holds them, the service cannot answer.
That last point is the one that matters. Being unable to answer "what do you hold, and where" about images of children is not a comfortable position for any organisation, and it is a particularly uncomfortable one for a service whose whole standing with families rests on trust.
Why the policy does not work
Most services that have noticed the problem have responded with a policy: personal devices are not to be used for photographing children. Many have a sign-in sheet or an acknowledgement form. And the practice continues, because the policy is asking educators to choose between a slower, more awkward compliant path and the phone already in their pocket.
Policy without tooling asks people to be inconvenienced on principle, every day, indefinitely. That is not a realistic ask of a busy educator in a room of toddlers, and it is unfair to blame the educator when it fails. The service has not provided a way to do the right thing that is as easy as the wrong thing.
This pattern shows up in every sector: shared logins on a reception desk, plans emailed around a building site, patient notes on a personal laptop. The fix is never a sterner policy. It is making the compliant path the convenient one.
What actually fixes it
Provide the devices. Room tablets or service-owned phones, enrolled in device management so the service can configure them, update them, locate them, lock them and wipe them remotely. A device the service owns is a device the service controls. Enough of them that an educator never has to reach for their own.
Give the images one destination. The device's camera should feed a managed location — the service's documentation platform, a controlled cloud library, whatever the service actually uses — and nothing else. No personal cloud sync, no camera roll that lives on the device indefinitely, no path to a personal account. Then "where are the images" has an answer.
Make it faster than the phone. If capturing an observation on the service device takes more taps than the personal phone, educators will drift back. Sign-in should be quick, the camera should be one tap away, and the upload should be automatic. Test it with an educator in a real room before rolling it out.
Handle offboarding as a matter of routine. When a staff member leaves, their access to the documentation platform ends, their service device is returned and wiped, and — because images never lived on their personal phone — there is nothing to chase. This is the part that only works if the earlier steps are in place.
Then write the policy. With the tooling in place, the policy becomes a description of how things already work rather than an aspiration. It is also enforceable, because there is no longer a reason to break it.
The wider record-keeping picture
Images are the visible tip of a larger obligation. Early learning services hold some of the most sensitive information any small organisation handles: identifying details about children, custody and family court arrangements, health conditions and allergies, developmental and behavioural observations, incident reports.
The retention obligations are unusually long. Under the Education and Care Services National Regulations, records relating to an incident, injury, trauma or illness involving a child must be kept until that child turns 25 — for an infant, close to a quarter of a century. Other records carry their own periods. No server, storage format or software vendor lasts that long, so this has to be designed as an archival problem rather than something a backup quietly handles. The same discipline that keeps images in one managed place is what keeps those records producible in 2048.
That combination — managed devices, one controlled destination for information about children, individual staff accounts with real offboarding, and retention designed to outlast the hardware — is the core of how we approach IT for childcare and early learning services, and the device management piece is usually where it starts.
A note on advice
The specific retention periods and record-keeping requirements that apply to your service depend on the current National Regulations and your approved provider obligations; check them directly rather than relying on a general summary. What does not depend on the detail is the principle: images of children should never sit somewhere the service cannot see, and the only reliable way to achieve that is to make the right way the easy way.
*Last updated: 17 September 2026.*