Children’s Data and EdTech: Data Protection Act Duties for Kenyan Schools and Online Providers

A school holds some of the most sensitive records a business can hold: identity details, health notes, results, images and, for an online school, a continuous digital trail of how each child learns. In Kenya that data is regulated by the Data Protection Act, 2019, and for schools the rules have sharper edges than most operators expect. One of them is a localisation rule that affects any online provider hosting learner data abroad. This article sets out the law on children’s data in Kenyan schools as at 24 October 2026.

Children’s data carries extra duties

Section 33 of the Data Protection Act says a controller or processor must not process a child’s personal data unless the child’s parent or guardian consents and the processing protects and advances the rights and best interests of the child. Section 33(2) requires mechanisms for age verification and consent, chosen with regard to available technology, the volume of data, the likelihood that the data is a child’s and the possibility of harm.

The Data Protection (General) Regulations, 2021 add to this. Regulation 13(2) prohibits profiling of a child that is related to direct marketing, and requires the parent or guardian to be told of the inherent risks of the processing and the safeguards in place. In practice, an enrolment form with a bundled consent tick-box is unlikely to be enough. The Office of the Data Protection Commissioner (ODPC) published a guidance note on processing children’s data in 2025. It has no separate chapter for schools or education technology, but it says parental consent is needed whatever the legal basis, that age verification must be proportionate, that children’s data should be kept only as long as necessary, and that processors should be vetted and bound by contract. Treat it as the regulator’s expectations, not as law.

Register with the Data Commissioner

Section 18 of the Act requires data controllers and processors to register. The Registration Regulations, 2021 exempt small operators, but only where annual turnover is below KES 5 million and there are fewer than ten employees (regulation 13(2)). Regulation 13(4) removes the exemption for operators whose processing falls within the Third Schedule, and item 4 of that Schedule is “operating an educational institution”. In our reading, a school or an online learning provider should assume it must register, whatever its size.

The localisation rule for basic education

Section 50 of the Act lets the Cabinet Secretary prescribe processing that may be done only through a server or data centre in Kenya. Regulation 26 of the General Regulations does so. Regulation 26(2)(e) lists processing of personal data “for the purpose of offering any form of early childhood education and basic education under the Basic Education Act, 2013”. For that processing, regulation 26(1) requires the controller or processor either to process through a server and data centre located in Kenya or to store at least one serving copy of the data in a data centre located in Kenya.

For a foreign-owned online school, this is a design requirement, not a footnote. A learning platform hosted entirely offshore, with no Kenyan copy of learner data, is difficult to square with the text. We would build the hosting architecture around a Kenyan serving copy from day one, and confirm the current position with the ODPC before launch, because regulations can be amended and we have read the version published on the ODPC website.

Sending learner data abroad

Where learner data does leave Kenya, sections 48 and 49 apply. Section 48 allows a transfer only on a stated basis: proof of appropriate safeguards given to the Data Commissioner, or necessity for a contract with the data subject or another listed ground. Section 49(1) says processing of sensitive personal data outside Kenya requires the data subject’s consent and confirmation of appropriate safeguards, and section 49(3) lets the Commissioner prohibit, suspend or condition a transfer. The General Regulations (regulations 40 to 48) set out how safeguards are shown and documented. A parent organisation abroad, an overseas platform vendor and a foreign cloud host each count as a transfer that needs a documented basis.

Impact assessments and vendors

Section 31 requires a data protection impact assessment before processing that is likely to result in high risk to individuals. Proctoring software, biometric attendance, behaviour analytics and AI tutoring tools aimed at children are the obvious candidates. Where a vendor processes learner data on the school’s behalf, the school remains the controller, so the vendor contract should cover purpose limits, security, sub-processors, location, retention, deletion and breach notification.

What is at stake

Under section 63, the Commissioner can issue a penalty notice of up to KES 5 million or, for an undertaking, up to 1 per cent of the preceding year’s annual turnover, whichever is lower. Section 64 allows an appeal to the High Court. Section 65 gives anyone who suffers damage from a contravention a right to compensation from the controller or processor. For a school the larger exposure is often reputational: parents decide quickly when the question is their child’s data.

The Basic Education Bill, 2026

The Basic Education Bill, 2026 would repeal the Basic Education Act, 2013, and clause 80 would require every institution to submit learner data to a central education management information system each year. The Bill was at First Reading in August 2026, so it is not law. In our reading, if it passes, regulation 26(2)(e) would still need to be checked against the new statute’s name, because it refers to the 2013 Act.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.