Yes, there is government guidance written for settings like yours. The Department for Education says its guidance applies to all out-of-school settings, and the list includes supplementary schools, such as those set up for language, cultural or religious purposes. It began as a voluntary code of practice and is still voluntary today. Some of what it points to is the law anyway.
This post covers England only, as of October 2026. The guidance page says it applies to England. This post does not cover Wales, Scotland or Northern Ireland. It is general information, not legal advice. Where a duty matters to you, read the source page linked under the post.
From code of practice to guidance
In December 2018 the DfE published a consultation on a draft voluntary safeguarding code for these settings. In its response to the consultation, the government said the code would remain voluntary and changed its title to non-statutory guidance for providers. So if someone on your committee asks about "the code of practice", this is the document they mean. It now sits on GOV.UK as Out-of-school settings: safeguarding guidance for providers.
It is kept up to date. The provider guidance was last updated on 9 February 2026, when the section on DBS checks for self-employed people and volunteers changed.
Voluntary, with legal duties underneath
The DfE's guidance for local authorities says out-of-school settings are not regulated under education or childcare law.
That is not the end of it. The same page says organisations must comply with relevant legislation where it applies to them, and gives vetting, health and safety, and fire safety as examples. Its list of out-of-school settings includes religious organisations offering education to children in their own faith.
What the guidance covers
The provider guidance covers the policies and procedures a setting should have in place for health and safety, safeguarding and child protection, safe and suitable people, and governance. The full document is a PDF of 53 pages. The DfE also publishes a shorter guide for parents, Using after-school clubs, tuition and community activities, which lists what parents are told to look for. Reading that guide is a quick way to see your madrasa the way a careful parent will.
Three written policies
The DfE guide for parents says that, as a minimum, providers should have policies on safeguarding and child protection, the suitability of all staff and volunteers, and health and safety.
The guide for parents says a copy of the child protection policy should be on the provider's website or given to parents on request. If yours lives in a folder in the office, keep a copy you can hand over the same day.
A named safeguarding lead
The guide says every provider should have a lead person who is responsible for safeguarding children in the setting, and calls that person the designated safeguarding lead. In a small madrasa this might be the head teacher or the most senior person on site in the evenings. Write the name down, and put it where staff and parents can see it.
Training is not a one-off. The lead should repeat their training at frequent intervals, or if the provider's circumstances change.
Safe staff and volunteers
The DfE says there is no single check that can be undertaken to show that a volunteer or staff member is suitable to work with children. The checks it lists include a person's identity and right to work in the UK, references before appointing anyone, and DBS checks for a criminal record.
Volunteers count. A parent who helps with a class every Saturday is part of your staffing, and the same questions apply.
The provider guidance was updated in 2023 to reflect new legislation on positions of trust. The guide for parents explains that it is an offence for a person over 18 to enter into a sexual relationship, or engage in certain other sexual activities, with a young person under 18 whom they knowingly teach, supervise or instruct on a regular basis in a sport or a religious setting. Your staff code of conduct is the natural place to make sure every teacher knows this.
Parents are told to check for a code of conduct for staff, volunteers and children, as well as for anyone visiting the premises.
Health, safety and first aid
The guide's checklist for parents also includes public liability insurance and DBS checks on staff and volunteers. Providers should be able to name an appointed person in charge of first aid.
The guide notes that a provider with fewer than 5 employees does not need a written health and safety risk assessment. It still expects providers to have carried out a risk assessment to identify what could cause injury or illness in their setting. A walk round the building before term, with notes, is a sensible start.
Children's records and who sees them
For each child, the guide says providers should collect at least one emergency contact number for the parent or carer, the parent's full name and the child's home address. If a child attends for more than a year, the provider should ask the parent for updated information. A yearly check at re-enrolment covers it.
Records held electronically should be password protected and encrypted, and paper copies kept in a locked container. The guide says only the designated safeguarding lead, or someone senior and trusted in the organisation, should have access.
That is harder with a shared spreadsheet than it sounds. In Hidayah, a class teacher sees only their assigned classes, and you can build a custom role for a volunteer or trustee with exactly the permissions they need. See staff roles and permissions for a madrasa for how the roles are split.
Online safety
The checklist for parents asks for an online safety policy regardless of whether children have access to online material at a setting. Many children bring phones, and teachers often message parents. A one page policy that says what staff may and may not do online is enough to begin with.
Complaints and concerns
All providers should have a clear policy to deal with complaints, according to the same guide. If the provider is a registered charity, parents can also raise a complaint with the Charity Commission.
Know who to call before you need them. The local authority designated officer at your council is responsible for dealing with allegations against people who work with children. Put that number in your safeguarding policy.
A checklist for your next committee meeting
Print this and fill in the last two columns. Every item comes from the sections above.
| Item | Have we got it? | Where is it kept? |
|---|---|---|
| Safeguarding and child protection policy, copy ready for parents | ||
| Policy on the suitability of staff and volunteers | ||
| Health and safety policy and risk assessment | ||
| Named designated safeguarding lead, training date recorded | ||
| Identity, references and DBS checks for every teacher and volunteer | ||
| Code of conduct for staff, volunteers, children and visitors | ||
| Named person in charge of first aid | ||
| Public liability insurance | ||
| Emergency contacts for every child, checked each year | ||
| Online safety policy | ||
| Complaints policy and the council's designated officer number |
Where to start this term
Start with training, because it costs only time. The DfE publishes safeguarding e-learning for providers, staff and volunteers, and its 6 modules take around an hour to complete in total. It is linked from the guidance page above.
Then ask your safeguarding lead to read the guide for parents and answer each of its questions as if a new family had asked. The DfE guide also says a well-run and trustworthy provider will welcome questions. Any question you cannot answer today is the next item on your list.
Questions madrasa committees ask about the DfE guidance
Is the DfE code of practice for out-of-school settings compulsory?
No. The government said the code would remain voluntary and renamed it non-statutory guidance for providers. The DfE says organisations must still comply with laws that apply to them, such as vetting, health and safety and fire safety.
Does the out-of-school settings guidance apply to a madrasa?
The guidance lists supplementary schools set up for language, cultural or religious purposes among the settings it applies to. It applies in England.
Does a small madrasa need a written health and safety risk assessment?
The DfE guide for parents says a provider with fewer than 5 employees does not need a written one. A risk assessment should still be carried out.
Who should be able to see children's records?
The guide for parents says only the designated safeguarding lead, or someone senior and trusted in the organisation, should have access to the information held about a child.
Where can madrasa staff get safeguarding training?
The DfE publishes safeguarding e-learning for out-of-school settings, linked from its guidance page. It has 6 modules that take around an hour in total.
Sources
- Department for Education: Out-of-school settings: safeguarding guidance for providers, checked 27 October 2026
- Department for Education: Out-of-school settings voluntary safeguarding code of practice, government consultation response, checked 27 October 2026
- Department for Education: Unregistered independent schools and out-of-school settings, guidance for local authorities, checked 27 October 2026
- Department for Education: Using after-school clubs, tuition and community activities, checked 27 October 2026