Data protection worries a lot of childminders, mostly because the word consent gets used wrongly so often. You don't need parents' consent for most of what you do with their information. You do need to tell them what you hold, why you hold it and how you look after it.
You're a data controller
You decide what information you collect about children and families and how it's used, which makes you a data controller under UK data protection law. Most childminders need to pay the ICO data protection fee, and small businesses pay the lowest tier. Check on the ICO's website whether it applies to you.
Your lawful basis is usually something other than consent
Most of what you hold is needed either to carry out your contract with the family, such as contact details and booked hours, or to meet your legal duties under the EYFS, such as attendance, accident and safeguarding records. You use health information because the child's care and safety depend on it. None of that relies on consent. Treating it as if it did would suggest families could withdraw it, and they can't.
Where consent does matter
Consent is the right basis for the optional things: photos shared on social media, photos on display in your setting, sharing information with another setting when you don't have to, and similar choices. Ask for each one separately, with a clear yes or no, make it easy to say no, and let families change their minds at any time.
Your privacy notice
Families must be told what you collect, why, who you share it with, how long you keep it and what their rights are. That's your privacy notice. It can sit in your contract pack, and it should say that you may share information with professionals, the local authority, the police or Ofsted when the law requires it or to keep children safe.
Keeping it secure
Lock paper records away, and keep digital records on encrypted devices with a password. Photos are a common weak spot, so decide whether you'll use a device kept only for your setting, and say so.
Retention
Keep records only as long as you need them, although some, such as accident records, may have to be kept for longer. Decide your retention periods and write them down.
This was the part of GoChildmind I most wanted to get right. It writes your privacy notice from your answers, asks for each optional consent separately in the family form, and never stores children's details online.