As another academic year takes place, schools, educators, and
staff must understand how the Protection of Personal
Information Act, 2013 ("POPIA")
applies to them and what their obligations are under POPIA. POPIA,
which came into full force and effect in July 2021, aims to protect
personal information against unlawful processing and applies across
all sectors, including the education sector. Where a school plans
to process personal information, it qualifies as a responsible
party and must comply with the provisions of POPIA.
Below are some POPIA do's and don'ts for schools to
consider:
Do's:
- Obtain consent from parents or legal
guardians:
POPIA requires that consent be obtained from a parent or legal
guardian (competent person) prior to collecting, processing, or
sharing any personal information relating to children. Consent must
be explicit, informed, and voluntary, and data subjects have the
right to withdraw consent at any time. If it is not possible
