Kenya's ODPC Education Sector Guidance — Enforced by a KES 950,000 Child-Data Ruling Against Nova Pioneer

Kenya's Office of the Data Protection Commissioner (ODPC), the regulator under the Data Protection Act 2019, issued a sector-specific Guidance Note for Education in February 2024, noting that the sector serves over 16 million children and youth yet many schools and EdTech providers had not completed data protection impact assessments, appointed data protection officers, or registered as controllers/processors.

The guidance requires schools to conduct a formal data protection impact assessment before adopting new EdTech or biometric tools, register with the ODPC, and put in place privacy notices and retention policies proportionate to risk.

The mechanism has real teeth: in ODPC Complaint No. 502 of 2024 (Fatuma Hadi Ali, on behalf of minor J.A.A., v. Nova Pioneer Kenya Limited), the Commissioner found the school breached Sections 33(1) and 37(1) of the Act by using a minor's photograph in billboard and website advertising without parental consent, and ordered KES 950,000 (approximately US$7,000) in compensation — one of several ODPC rulings in 2024 addressing the unauthorised use of children's images in Kenyan schools.

Read the full analysis: https://www.odpc.go.ke/wp-content/uploads/2024/02/ODPC-Guidance-Note-for-the-Education-Sector.pdf