Children's data is held to a higher standard
Where an organisation processes children's data, the Act applies heightened protection. Consent for a child's data rests with the parent or guardian, not the child, and the threshold for what is lawful is higher. Schools therefore carry obligations that ordinary businesses do not.
Education is in the first inspection group
POTRAZ has named education — schools, colleges and universities — among the priority sectors for inspection from 1 September 2026. Heads and bursars should expect to be asked, not to hope to be overlooked.
The gaps we see most in schools
The gaps that recur are practical, not theoretical: class WhatsApp groups that expose every parent's phone number to every other parent; photographs of children published in newsletters or online without consent; leavers' files kept indefinitely because no one is sure they can be deleted; marks and reports sent over personal email accounts; biometric or card systems installed without a data-protection assessment; and third-party portals and apps engaged with nothing in writing about how the provider handles the data.
A workable checklist for heads and bursars
Confirm the school's licence status with POTRAZ. Appoint a DPO in writing. Build the processing register — staff, learners, parents, exam data, CCTV. Move class groups to broadcast mode so numbers are hidden. Adopt a consent process for photographs. Set a retention schedule for leavers' files. Put a processor agreement in place with every app and portal that touches learner data. Train staff so that the inspection finds awareness, not surprise.
Sources: Cyber and Data Protection Act 5 of 2021 [Chapter 12:07]; Statutory Instrument 155 of 2024; POTRAZ inspection announcement (1 September 2026).
This is general guidance, not legal advice. Your licence category is determined by POTRAZ on assessment of your application.