 concerns 441. All low-level concerns should be recorded in writing. The record should include details of the concern, the context in which the concern arose, and action taken. The name of the individual sharing their concerns should also be noted, if the individual wishes to remain anonymous then that should be respected as far as reasonably possible. 442. Schools and colleges can decide where these records are kept, but they must be kept confidential, held securely and comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). 443. Records should be reviewed so that potential patterns of inappropriate, problematic or concerning behaviour can be identified. Where a pattern of such behaviour is identified, the school or college should decide on a course of action, either through its disciplinary procedures or where a pattern of behaviour moves from a low-level concern to meeting the harm threshold, in which case it should be referred to the LADO (as per Part four, Section one). Consideration should also be given to whether there are wider cultural issues within the school or college that 111 enabled the behaviour to occur and where appropriate policies could be revised, or extra training delivered to minimise the risk of it happening again. 444. It is for schools and colleges to decide how long they retain such information, but it is recommended that it is retained at least until the individual leaves their employment. References 445. Part three of this guidance is clear that schools and colleges should only provide substantiated safeguarding concerns/allegations (including a group of low- level concerns about the same individual) that meet the harm threshold in references. Low-level concerns should not be included in references un