evidoria

← Back to browse

Good practice Imported

Kenya's ODPC Education Sector Guidance — Enforced by a KES 950,000 Child-Data Ruling Against Nova Pioneer

Kenya · Nairobi · See the Kenya profile · See the Nairobi profile

Evidence: Descriptive / self-reported Top 56% 47/100 · Ask Evidence Copilot about this practice

Kenya's ODPC issued a 2024 Guidance Note requiring schools/EdTech to run data-protection impact assessments and register as controllers, then enforced it: Nova Pioneer Kenya was ordered to pay KES 950,000 for using a minor's photo in ads without parental consent.

950,000 KES
Compensation ordered against Nova Pioneer Kenya (2024)
over 16 million
Children and youth served by Kenya's education sector

Details

Maturity
Scaling
Promoter
Office of the Data Protection Commissioner (ODPC), Kenya
Period
2024
Keywords
data protection, children's privacy, education regulation, enforcement

Context

Kenya's Office of the Data Protection Commissioner (ODPC), the regulator under the Data Protection Act 2019, issued a sector-specific Guidance Note for Education in February 2024, noting that the sector serves over 16 million children and youth yet many schools and EdTech providers had not completed data protection impact assessments, appointed data protection officers, or registered as controllers/processors.

Objectives

The guidance requires schools to conduct a formal data protection impact assessment before adopting new EdTech or biometric tools, register with the ODPC, and put in place privacy notices and retention policies proportionate to risk.

Activities

The mechanism combines published sector guidance with active case enforcement; in ODPC Complaint No. 502 of 2024 (Fatuma Hadi Ali, on behalf of minor J.A.A., v. Nova Pioneer Kenya Limited), the Commissioner found the school breached Sections 33(1) and 37(1) of the Act by using a minor's photograph in billboard and website advertising without parental consent.

Results

The Commissioner ordered Nova Pioneer Kenya to pay KES 950,000 (about US$7,000) in compensation -- one of several ODPC rulings in 2024 addressing the unauthorised use of children's images in Kenyan schools, demonstrating that the guidance carries real enforcement consequences rather than being advisory only.

Implementation
Indicative cost
Low (< €50k) — No implementation budget is reported; the mechanism combines free published guidance with case-by-case enforcement funded through the ODPC's existing regulatory operations.
Time to results
Long (> 3 years) — Guidance issued February 2024; the Nova Pioneer ruling and other cases were decided within the same year, indicating an active, ongoing enforcement track rather than a time-limited pilot.
Staffing & skills
Office of the Data Protection Commissioner (ODPC), Kenya

Conditions for success

  • A statutory data-protection regulator with investigative and adjudicative powers under the Data Protection Act 2019
  • Willingness of affected families to file complaints (as in Complaint No. 502/2024)
  • Schools/EdTech providers completing data protection impact assessments and registering as controllers/processors

Common failure modes

  • Only one adjudicated case is documented here; broader sector-wide compliance statistics are not published
  • Enforcement depends on individual complaints being filed rather than proactive systemic audits

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Replication kit

Reusable artefacts from this practice — as published by their sources.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful