Child's nursery records: GDPR access request only with both parents

A GDPR access request at the nursery

A father lives apart from the mother of his son; they share parental responsibility. The boy attends a nursery. The father wants to know what the nursery records about his child and, in 2023, asks the management for access to that information under the General Data Protection Regulation (GDPR). Specifically, he asks for the development records in which the nursery documents the child's educational and developmental progress. The management refuses: this would require the mother's consent, and she has not given it.

The father complains to the Berlin Commissioner for Data Protection and Freedom of Information, without success. The Berlin Administrative Court dismisses his action against that outcome in a judgment of 30 June 2026 (case no. 42 K 41/25). The key message: a separated parent who requests their child's nursery records by way of a GDPR access request needs the other parent's agreement. Using the GDPR as a short cut around the family court does not work.

Complaint to the data protection authority

In October 2023, the father lodges a complaint with the data protection commissioner, arguing that access has been wrongly refused. The authority obtains a statement from the nursery provider and closes the case in January 2025 with a final notice. A breach of the GDPR cannot be established beyond doubt. Anyone who does not hold parental responsibility cannot represent the child. Whether the father has parental responsibility in nursery matters is a question of family law, to be resolved by the family court.

The father is not satisfied with this. At the end of January 2025 he brings an action before the Administrative Court. The authority is to set aside the final notice and decide on his complaint afresh, on the basis that he is entitled to request the information. The court decides without an oral hearing because both sides agree to this. The amount in dispute is set at EUR 5,000.

What the authority has to examine

In the court's words, a data protection authority must deal with every complaint, investigate the subject matter to an appropriate extent and inform the complainant of the progress and outcome. How deeply it investigates depends on the individual case. The decisive factors are the seriousness of the interference with the rights of the data subject as well as the authority's resources and options. The administrative courts review its decision in full as to substance. Only on the question of whether and how the authority takes action against a breach does it have a margin of discretion.

This results in a two-stage review. First, the question is whether the authority examined to an appropriate extent whether a breach had occurred. If a breach is established, the complainant is then entitled, at the second stage, to a discretionary decision, free of error, on whether to take action. The father's case ends at the first stage. In the court's view, the authority investigated sufficiently, and there was no breach of the GDPR.

The data subject is the child

The right of access under the GDPR belongs to the data subject, that is, the person whose data is involved. Here that is the son, because the development records describe him. The father is therefore asserting a right belonging to his child. Anyone requesting information on behalf of another person needs valid authority to represent them. In the case of a minor child, this is generally the parents as legal representatives.

This is where the case turns. The father does have parental responsibility, but not alone. He shares it with the mother, from whom he lives apart. For this access request he was therefore not permitted to represent his son without her agreement.

Why the mother has to agree

Family law governs how separated parents with joint parental responsibility take decisions. In matters whose resolution is "of considerable significance" for the child, they need mutual agreement. Everyday questions, by contrast, are decided alone by the parent with whom the child lives. So the question is: is an access request to the nursery a matter of considerable significance?

The court says yes: such matters include educational questions in the broadest sense, including care and early-years education at nursery. In the court's view, the development records are an essential building block of the child's educational development. They record the educational and developmental steps taken, and they form the basis for decisions that both parents must take jointly, such as the choice of educational setting. The access request therefore concerns a joint matter. It could not be made without the mother, and the nursery was right to refuse access.

What this means for separated parents

At first glance, the GDPR looks like a convenient route to information about your own child: submit a request, receive the documents. For separated parents with joint parental responsibility, this judgment means the route only leads anywhere if they take it together. Anyone who wants the nursery records needs the other parent's agreement. If the nursery refuses access on that basis, it is not breaching the GDPR. A complaint to the data protection authority changes nothing, and an action against the authority costs time and money, as this case shows.

The first step is therefore a conversation with the other parent. If they agree, there is nothing standing in the way of access. If the dispute remains, the family court has jurisdiction. The data protection authority had already taken that view in its final notice, and the court confirms it.

Family law also provides a separate claim, independent of the GDPR. Where there is a legitimate interest, each parent can ask the other for information about the child's personal circumstances. For nurseries and their providers, the judgment works the other way round. If only one parent asks for the child's records, the nursery may ask about parental responsibility and about the other parent's agreement.