Learners’ data and photos: what Kenyan schools should know

Schools are data controllers

Schools collect a lot of personal data about children: names, health information, photos, results and family details. Under the Data Protection Act 2019, that makes them responsible for how it is collected, used, stored and shared.

The ODPC’s Guidance Note for the Education Sector states that educational institutions are subject to mandatory registration with the Office, regardless of their size or annual turnover.

Photos need explicit consent

A child’s image is personal data. The ODPC’s guidance says schools should obtain explicit consent from parents or guardians before publishing or sharing photographs of children, especially in public places such as websites, newsletters and social media.

• Explain the purpose of the photos and where they will be published.
• Only photograph or publish learners whose parents agreed.
• Avoid adding names or other identifying details to published photos.
• Don’t reuse photos for other purposes, or share them on staff members’ personal accounts.

Collect less, keep it safe

Collect only the data you need, set clear retention periods and review them. If personal data is lost or exposed — for example, a lost USB drive — the guidance expects the school to notify the ODPC and the people affected within 72 hours of becoming aware of it.

In 2025 the ODPC also published a guidance note on processing children’s data, which puts the best interests of the child first and asks organisations to verify that consent really comes from a parent or guardian.