This article is general guidance, not legal advice. Check current requirements with the Office of the Data Protection Commissioner (ODPC) or a lawyer.
The law in brief
Kenya's Data Protection Act, 2019 governs how organisations collect, use, store and share personal data. It is enforced by the Office of the Data Protection Commissioner (ODPC). The Act applies to private schools, colleges and training centres, as well as to the companies that build and host their systems.
Does your school need to register with the ODPC?
Under the 2021 registration regulations, most small organisations are exempt from registering if they have both an annual turnover below KES 5 million and fewer than ten employees. However, some sectors must register regardless of size, and education is one of them. In practice, that means most schools should register as data controllers. A registration certificate is valid for two years, so put the renewal date in the school calendar.
Children's data needs extra care
The Act requires that children's personal data is processed with the consent of a parent or guardian, and in a way that protects the child's rights and best interests. The ODPC has also published a guidance note on processing children's data. For your website, that means:
- Get written consent before publishing photos or names of students, and respect parents who say no.
- Avoid publishing full names together with class, photos and location details.
- Never use children's data from admissions forms for marketing.
Enquiry and admissions forms
Collect only what you need at each stage. At the enquiry stage, a parent's name, phone, email, the child's grade and a message is usually enough. Medical details, previous reports and identity documents belong later in the admissions process, in a secure system, not in a general email inbox.
Every form should link to your privacy notice and say plainly what happens to the information.
What your privacy notice should say
- Who you are and how to contact you about data
- What personal data you collect, and why
- Who you share it with, such as your website host, email provider or school management system
- How long you keep it
- How people can access, correct or delete their data, or object to how it is used
- Whether any data is stored outside Kenya, which is common with cloud services
Security basics for the website
- HTTPS on every page, so form data is encrypted in transit.
- Strong, unique passwords and two-factor authentication for every admin account.
- Prompt software updates and regular, tested backups.
- Access to enquiries limited to the staff who need it, and removed when staff leave.
If something goes wrong
If a personal data breach creates a real risk of harm, the school, as data controller, must notify the Data Commissioner within 72 hours of becoming aware of it. A web developer or host acting for the school must tell the school within 48 hours. Agree in writing with your providers how they will alert you.
Where to start this term
- Check whether your school is registered with the ODPC, and when it renews.
- Review every form on your website and remove fields you don't need.
- Publish a clear privacy notice and link it from each form.
- Collect photo consent from parents at enrolment.
- Confirm that your website has HTTPS, backups and two-factor logins.
Ask for a data protection review of your website
Technology specialists, teachers and education leaders who build websites, software and training for schools and organisations. About our team
Enjoyed this? Get one tip a month.
Short, useful notes on websites, data protection and AI for schools and organisations. No spam; unsubscribe any time.