arrow_back Back to Blog

What Kenya's ODPC Data Privacy Rules Mean for Your School

Kenya's Data Protection Act and the Office of the Data Protection Commissioner (ODPC) have moved from awareness to enforcement. Schools that collect, process or store personal data — which includes every student's name, parent contact, academic record and payment history — are classified as data controllers and processors under the law. Here is what you need to know and do.

Who Does the Law Apply To?

If your school collects any personal data about students, parents or staff — and every school does — the Data Protection Act applies to you. Specifically:

• Student admission records (names, dates of birth, home addresses)
• Parent and guardian contact information
• Medical and health information
• Fee payment records and financial data
• Academic performance records
• Biometric data (fingerprints, if using biometric attendance)
• CCTV footage (if the school uses security cameras)
• Staff employment records

The law does not distinguish between large schools and small ones. A 200-student primary school has the same compliance obligations as a 2,000-student secondary school.

Key Obligations for Schools

1. Register with the ODPC

Schools that process personal data must register as data controllers and processors with the ODPC. Registration is done online at the ODPC portal. Failure to register is a compliance violation that can result in fines.

2. Have a Privacy Policy

Your school must have a documented privacy policy that explains what personal data you collect, why you collect it, how you store it, who you share it with, and how individuals can access or request deletion of their data. This policy should be available to parents at admission and on your school website.

3. Collect Only What You Need

The data minimisation principle requires schools to collect only the personal data that is genuinely necessary for the purpose stated. Collecting parent workplace details, for example, is only justified if there is a specific reason for it.

4. Get Consent

For certain types of data processing — particularly sharing data with third parties or using data for purposes beyond the original collection — you need explicit consent from the data subject (or their parent/guardian for minors). Your admission form should include clear consent statements for each type of data processing.

5. Secure the Data

Schools must implement appropriate technical and organisational measures to protect personal data. At minimum this means: password-protected systems, role-based access control, regular backups, and a procedure for reporting data breaches.

6. Respond to Data Requests

Individuals (or parents on behalf of minor children) have the right to access their personal data, request corrections, and in some circumstances request deletion. Schools must have a process for handling these requests within the timeframes the law specifies (typically 21 days).

Special Considerations for Biometric Data

Biometric data — fingerprints — is classified as sensitive personal data under the Data Protection Act and requires explicit, informed consent before collection. Schools using biometric attendance systems must ensure that every student's parent or guardian has signed a specific consent form for fingerprint data collection, and that this data is stored securely with access strictly limited.

What Happens If You Don't Comply?

The ODPC has powers to investigate complaints, conduct audits and impose penalties. Fines for data protection violations can be significant — up to KES 5 million or 1% of annual turnover, whichever is higher. More importantly, a data breach or misuse of student information can cause serious reputational damage to a school.

Choosing a Compliant School Management System

Your school management software vendor is a data processor under the law — they process student data on your behalf. Choose a vendor that is itself ODPC-registered, can demonstrate secure data handling practices, and is clear about where your data is stored and who can access it.

Shule Link is a registered data processor with the ODPC and stores all data on servers compliant with Kenya's data localisation requirements.