Online safety policy for international schools: what to cover

An online safety policy tells every adult and child how technology is used at your school and what to do when something goes wrong. It belongs inside your child protection policy, with the same owner and the same reporting route.

Keeping Children Safe in Education (KCSIE) 2026, the statutory guidance for schools in England, says online safety should be reflected in the child protection policy.

KCSIE binds schools in England only. International schools often use it as a reference, and this guide to KCSIE outside England shows how. The law of your host country still applies on your campus, so ask a local lawyer about data protection and reporting duties.

KCSIE sorts online risk into four areas, known as the four Cs. They apply in any country, so they make a sound base for your own risk assessment.

Each risk shows up differently in a boarding school with teenagers and a day school with young children. Ask students which apps they use now, because the answer changes fast.

The United Nations Children's Fund (UNICEF) names similar harms, including adults who build trust with a child and then pressure them to share images. KCSIE suggests an annual review of your online safety approach, backed by a risk assessment.

• Content: harmful material such as pornography, self-harm content, extremism and fake news.
• Contact: harmful contact with others, including adults who pose as children to groom or exploit them.
• Conduct: harmful behaviour, including bullying and sharing nude images, even those made with artificial intelligence (AI).
• Commerce: gambling, scams, phishing and inappropriate advertising.

List every device and account on your network: school laptops, student phones, staff phones, guest devices and cloud accounts. For each one, say who manages it, what is filtered and what is monitored. Your filter cannot see a child's home connection, so tell families what to do there.

The Department for Education (DfE) in England publishes filtering and monitoring standards that work as a checklist for any school. They ask you to assign roles, review the system each academic year, and block harmful content without getting in the way of teaching.

KCSIE also warns that too much blocking can stop teachers from teaching children about online risks.

The standards split the work four ways. The board holds overall responsibility, a senior leader runs the system, the DSL reads reports and responds to concerns, and the technology team keeps it working.

Test filtering on school devices on and off campus, and record the date, the tester, what was tested and what changed. The DSL guide to filtering and monitoring sets out the steps. Then state these points in plain words.

• Which devices the school manages and which students bring from home.
• What the school filters and monitors, in words families can understand.
• Who receives monitoring alerts and who acts on them the same day.
• How you check new apps and generative AI tools before students use them.

Filters never catch everything, so the policy needs a teaching plan. Say which year groups learn what, who teaches it, and where it sits in the timetable, such as advisory, personal education or computing.

KCSIE lists topics such as healthy relationships, consent, sharing images, deepfakes and pornography, and when to ask for help. The Council of International Schools (CIS) describes child protection standards that include education for students on behaviour and boundaries.

Some children stay quiet because they fear losing their phone or getting into trouble. Give students one clear message and repeat it in lessons and assemblies: "If something online upsets or worries you, tell any adult at school. Telling us is always the right thing to do."

Include families too. Share which apps students use, what the school filters and how to report a worry, and offer the summary in the languages your families speak. The International Telecommunication Union (ITU) publishes guidelines for parents and educators that countries can adapt.

Use the route you already have. Anyone can tell a trusted adult, and that adult tells the DSL the same day, following your child protection procedure. If a child is in immediate danger, call local emergency services first.

Add an anonymous online form for students who find it hard to speak aloud, and show the DSL's name and photo where students can see them.

When a student shows a member of staff an image, the adult should not view, copy or forward it. KCSIE is clear that staff should not view or forward illegal images of a child. The same steps apply to AI-made nude images.

The DSL decides what happens next, including reports to the platform, the police or the local child protection agency. Reporting duties differ by country, so confirm the local route with a lawyer. A student worried about an image can also use Take It Down, a free tool that helps stop images of under-18s spreading on taking-part platforms.

Give staff short words to use when a child tells them something online.

• "Thank you for telling me. You did the right thing."
• "I cannot keep this secret. I need to tell our safeguarding lead so they can help."
• "Please do not send it to anyone else. Our safeguarding lead will tell you what happens next."

Staff conduct online needs its own part in your staff code of conduct. KCSIE says that code should cover acceptable use of technology, including mobile devices, and staff and student communication, including social media.

The code should also say where to take a concern about a colleague's online behaviour. Link it to your allegations procedure and your low-level concerns policy, and say that speaking up is expected. See teacher and student messaging for details.

The National Society for the Prevention of Cruelty to Children (NSPCC) lists images of children as an area to cover. Write rules staff can follow without asking a lawyer.

• Contact students only through school email and school platforms.
• Do not share personal phone numbers or social media accounts with students, or accept their friend requests.
• Take photos of students only on school devices, within your image consent rules.
• If a student messages you privately, do not reply there. Tell the DSL.
• Keep student data out of AI tools the school has not approved.

Name an owner for each part and put the names in writing. KCSIE gives the DSL lead responsibility for online safety, including understanding the filtering and monitoring systems, and wants this in the DSL's job description.

Review the whole policy every year, using a risk assessment that reflects your students. Review sooner when something changes, such as a new platform, a new device programme or a serious incident.

Give the board a short summary each term covering online concerns, filtering checks and training, without anything that could identify a child. Train every adult on the policy at induction and at least once a year.

Then test the policy with these questions.

• Can a student name two adults they would tell?
• Can a teacher say what to do when a student shows them an image?
• Can your technology lead show the date of the last filtering check?
• Can parents read a summary in a language they speak at home?
• Does the board see online safety figures every term?