Schools, colleges, and universities in Kenya collect and process large amounts of personal
information every day from student admission records and academic performance data to
staff information and CCTV footage.
Under the Data Protection Act, 2019, this makes them data controllers and processors with a
legal duty to safeguard that information.
Educational institutions must ensure that personal data is:

• Collected lawfully and fairly, with clear notice to students, parents, and staff.

• Used only for the stated educational or administrative purpose.

• Stored securely, whether in digital or paper format.

• Shared only where necessary, such as with regulators or exam bodies, and with appropriate safeguards.

• Retained and disposed of responsibly, in line with data minimisation and retentio nprinciples.

At South-End Tech Ltd, we help schools and higher education institutions build data
protection into their daily operations.
Our services include mapping student and staff data flows, developing privacy notices, and
consent processes, conducting data protection audits, and train your staff to handle data
responsibly.