Every school in Kenya holds personal data: learners' names and dates of birth, parents' phone numbers and ID numbers, medical notes, discipline records, photos and fee balances. Under the Data Protection Act, 2019, the school is responsible for how that data is collected, used, stored and shared, even when it lives in a system run by someone else.
This isn't legal advice, but it covers the principles every head teacher and board should know.
For your school's specific obligations, including whether you must register with the Office of the Data Protection Commissioner (ODPC), check the ODPC's guidance or ask a legal adviser.
The principles, in school terms
- Collect only what you need. An admission form needs a parent's phone number. It probably doesn't need their employer's address.
- Use data only for the reason you collected it. Phone numbers collected for school communication shouldn't be handed to a uniform supplier for marketing.
- Keep it accurate. Update contacts every year. Wrong numbers mean absence alerts go to the wrong person.
- Keep it secure. Only people who need data should be able to see it.
- Don't keep it forever. Agree how long you keep records of learners who have left, and what happens to them after that.
- Children's data needs extra care. Get parents' consent before publishing photos of learners, on the website, in ads or on social media.
Who should see what
Most data leaks in schools are not hacks. They are spreadsheets emailed to the wrong person, or a shared login everyone knows. Good access control means:
- Every staff member has their own login. No shared "office" account.
- Each role sees only what it needs. The bursar sees fees, not discipline notes. A teacher sees their own classes, not the school's bank settings. A librarian sees the library.
- Parents see only their own children. Learners see only themselves.
- Accounts are closed when people leave.
In Class Compass, permissions are set per role and checked by the server on every request, not just hidden in the menu. A teacher's login can't open payroll even by typing the address directly.
Simple habits that protect data
- Stop emailing spreadsheets of learner data. Share access in the system instead.
- Use strong, separate passwords and never write them on the staffroom notice board.
- Lock screens on office computers when you step away.
- Check consent before posting photos of learners, especially in marketing.
- Ask your system provider where data is stored, how it is backed up, and how you can export it if you ever leave.
Make it part of the culture
Data protection works best as a habit, not a policy document in a drawer. Mention it at the start-of-year staff meeting, include it in new-staff induction, and tell parents how their data is used and protected. They'll trust the school more for it.