Who Owns Your School's Data? Why It Should Be the School, Not the Vendor
Every school management system holds the most sensitive data a family will ever hand an institution: a child's name, age, medical notes, home address, guardians, and fee history. So here is the question few schools ask before signing up: when the contract ends, who keeps the data, and could you get it back?
The law is already clear
Under Kenya's Data Protection Act, 2019, the school is the data controller for its learners' personal data. The software vendor is, at most, a data processor acting on the school's instructions. That is not a marketing distinction, it carries duties. The controller decides how data is used, must be able to produce it, and is accountable to parents and to the Office of the Data Protection Commissioner.
Yet many systems are built the other way round: your data lives in the vendor's central database, blended with every other school's, and "export" means a support ticket and a CSV if you are lucky.
Three questions to ask any vendor
- Can we export everything, on demand, in a usable format? If the answer is "contact support", the answer is no.
- Is our data isolated from other schools'? One school's admin should never, through any bug, see another school's children. Ask how that isolation is enforced, at the database, not just the application.
- What happens if we leave? A school should be able to walk away with its complete records intact.
Opero's stance
Opero is built so that Opero runs the system and the school controls the data. Each school's records are isolated at the database level, backups are encrypted before they leave the server, and the school can take its data with it. Software should be a tool the school wields, not a landlord that holds the school's own history hostage.
Choosing a system is choosing who you trust with children's records. Choose the arrangement where the answer to "who owns this?" is always: the school.
Read how this plays out in transport safety records, or talk to us about migrating your data.