Data Protection for Kenyan Schools: An ODPC and DPA 2019 Checklist for School Leaders

A school posts photos from sports day on its social media page. The children are smiling, the parents are proud, and the post brings in admissions enquiries. Then one parent complains to the Office of the Data Protection Commissioner that their child's image was used to market the school without their consent. In 2023, the ODPC fined a Nairobi primary school KSh 4.55 million in exactly such a case, describing it at the time as the highest penalty it had issued to an educational institution. The school challenged the decision in court, but the message to every school leader was clear.

Schools hold some of the most sensitive personal data in the country: children's names, dates of birth, photographs, health conditions, family circumstances and fee positions. The Data Protection Act, 2019 treats children's data with particular care, and the regulations made under it name education as a sector that must register with the ODPC. Yet many schools still run on habits that predate the Act: class lists shared on WhatsApp, medical forms in an unlocked cabinet, and photographs posted without asking.

This article is a practical checklist for principals, deputies and bursars. It is not legal advice, and a school should take advice from an advocate on its own circumstances. But it covers the areas where schools most often fall short, and what good practice looks like in each.

Know your role: the school is the data controller

Under the Act, the data controller is the person or body that decides why and how personal data is processed. For a school, that is the school itself, through its proprietor or Board of Management. Software vendors, payroll bureaus, SMS providers and bus contractors who handle data on the school's behalf are data processors, acting on the school's instructions.

This matters because the duties fall mainly on the controller. The school must have a lawful basis for what it collects, keep it secure, respond to requests from parents and staff, and report breaches. It cannot hand those duties to a vendor by signing up for a system. It should, however, have a written agreement with each processor setting out what they may do with the data. Our piece on who owns your school's data covers the controller and processor split in more depth.

Register with the ODPC

The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 require registration with the ODPC. The general exemption for small organisations does not apply to sectors listed in the regulations for mandatory registration, and commentary on the regulations and ODPC communications have listed education among those sectors, so a school should assume it must register regardless of its size. Registration is done online through the ODPC, with a prescribed fee, and certificates are reported to be valid for 24 months, after which they must be renewed. In 2026 the ODPC has publicly pressed organisations with expired certificates to regularise their status.

Check the ODPC's current guidance and fees on its own website before applying, and diarise the renewal date.

Registration is not compliance, but failing to register is the easiest breach for a regulator to prove.

Consent for children's data, especially photos

Section 33 of the Act deals with children's data. It requires that processing be done in a way that protects and advances the rights and best interests of the child, and generally requires the consent of a parent or guardian. In practice, consent should be specific: agreeing to the school keeping an admission record is not the same as agreeing to a child's photo appearing on the school's Facebook page.

A sound approach records consent per guardian, per child and per purpose: core school records, health information, photos used inside the school, photos used publicly, and contact by SMS or other channels. It records when consent was given, against which version of the wording, and treats withdrawal as a new record rather than rubbing out the old one, so the school can show what was agreed at any time. Before any photo or video goes on a public page, someone should check that consent for public use exists for every identifiable child in it.

Health and other sensitive data

The Act gives extra protection to sensitive personal data, which includes health information. A child's allergies, medication, chronic conditions and medical reports should be visible only to the people who need them, typically the school nurse and the head, and any teacher who must know in order to keep the child safe. They should not sit in an open staff room file or a spreadsheet emailed between teachers.

The same logic applies to safeguarding records, counselling notes and details of family circumstances. Ask, for each kind of record: who actually needs to see this, and does our current system stop everyone else?

Requests from parents and staff

Parents, on behalf of their children, and staff have rights under the Act, including the right to be informed, to access their data, to have it corrected, to object to some processing and, in some circumstances, to have it deleted. A school should have a simple, known route for these requests and someone responsible for answering them within the timelines the law sets.

Keep a record of each request, what was done and when. Deletion requests need care, because some records, particularly financial ones, may have to be kept for legal or accounting reasons; in that case the school can remove what identifies the child while keeping what it is required to keep. Take advice on how long each kind of record should be retained, and write it down as a retention schedule.

Breaches: have a plan before you need it

A breach is any incident that exposes personal data to people who should not have it: a stolen laptop with learner records, a class list sent to the wrong WhatsApp group, a hacked email account. Section 43 of the Act requires the controller to notify the Data Commissioner within 72 hours of becoming aware of a breach where there is a real risk of harm, and in some cases to tell the affected people.

Seventy-two hours passes quickly in a school week. Decide now who leads on a breach, who decides whether it must be reported, and how the school will contact the ODPC and families. Keep a short record of every incident, including those not reported, and what was done.

The time to decide who reports a breach is before the laptop goes missing, not after.

Everyday habits that prevent most problems

Most data protection failures in schools are not sophisticated. They are habits. Stop sharing class lists, results and fee arrears in parent or staff WhatsApp groups. Give each staff member their own login and never share passwords. Lock away paper records and shred what is no longer needed. Remove access promptly when staff leave. Be careful with exports: a spreadsheet of every learner with dates of birth and parents' phone numbers should be produced rarely, by few people, and deleted after use. And train staff once a year, briefly, on what the Act asks of them.

Questions to ask your vendors

Because the school is the controller, it should ask every processor that handles its data some direct questions. Where is the data stored, and who at the vendor can see it? Is our data kept separate from other schools' data, and how? Can we export all of our data, and what happens to it if we leave? How will you tell us about a breach, and how quickly? Is there a written processor agreement we can sign? Is the data encrypted, both in transit and on disk?

A vendor should be able to answer each question plainly, including saying where something is not yet in place. A vendor who cannot, or who answers every question with reassurance rather than facts, is a risk the school is carrying on its own register.

Where Opero fits

Opero is built so that a school can follow these practices without workarounds. Guardian consent is recorded per guardian, per learner and per purpose, including core processing, health, internal and public photos, and contact channels, with a version and date, and withdrawal is added as a new record rather than overwriting the old one. Health records are limited to roles such as the nurse and head teacher. Parents can raise access, correction, erasure, portability and objection requests from the parent portal, and the office handles them on a dedicated screen, with notes kept on the record. Erasure is restricted to the head teacher, who must type the admission number to confirm; it removes identifying details and health records while keeping financial records in de-identified form.

Every school's data is isolated from every other school's at the database level, staff use two-step sign-in, and significant actions go into an audit trail staff cannot edit. In Opero's arrangement the school is the data controller and Opero acts as a processor. Opero does not register the school with the ODPC or give legal advice; the school remains responsible for its own registration, policies and decisions.

Key takeaways

• The school is the data controller and carries the main duties; vendors are processors acting on its instructions.
• Education is reported as a sector that must register with the ODPC regardless of size; check your registration and renewal date.
• Record consent per child and per purpose, and check public-use consent before posting any photo.
• Restrict health and other sensitive records to the people who need them.
• Have a route for parent and staff requests, a retention schedule, and a breach plan that meets the 72-hour notification rule.

Frequently asked questions

Does a small private school need to register with the ODPC? Education is listed in commentary on the registration regulations and in ODPC communications as a sector subject to mandatory registration regardless of size. Confirm the current requirements on the ODPC website and register if you have not.

Can we post photos of learners on social media? Only with appropriate consent from a parent or guardian for that specific use. Consent for school records is not consent for public marketing. Check consent for every identifiable child before posting.

What should we do if a laptop with learner records is stolen? Follow your breach plan: contain the incident, assess the risk, and if there is a real risk of harm, notify the Data Commissioner within 72 hours of becoming aware, and consider whether families must be told.

Can a parent demand that we delete their child's records? Parents can request erasure, but some records may need to be kept for legal or financial reasons. Take advice, record the request and your decision, and remove what you are not required to keep.

See the data protection controls for yourself

The best way to judge a system's data protection is to sign in with different roles and see what each person can and cannot reach.

Book a demo and we will walk through consent records, data requests, health record access and the audit trail on a setup that matches your school.