The Law is Already There; the Problem is Enforcement.
Africa has made striking progress on paper. As of early 2024, 36 of the continent’s 55 countries have enacted data protection laws, and a third of those laws were passed in the last five years alone. The African Union adopted the Malabo Convention back in 2014, making it the only regional treaty in the world to bring cybersecurity and personal data protection under one legal roof.
Yet the gap between law and practice remains wide. Only 15 countries have ratified the Malabo Convention. Many nations still have no data protection authority with real independence or resources. And institutions like schools that handle sensitive information about children every single day have largely been left to figure things out on their own.
The result is a system where student data flows freely: photos used in marketing without parental consent, exam results shared commercially, biometric data collected through apps with no clear privacy policies. Most parents and students have no idea this is happening, and most schools have no idea it is illegal.
Schools Are Now Being Fined, and the Cases Are Instructive
Kenya offers the clearest picture of what happens when enforcement catches up with reality. The country’s Office of the Data Protection Commissioner has issued guidance specifically for schools, requiring them to register as data controllers, appoint a dedicated data protection officer, and run formal risk assessments before rolling out any new digital tool or biometric system.
These are not just guidelines. Schools that ignore them face penalties.
In June 2024, a private school network was ordered to pay KES 950,000 (~$7400) after it used a student’s image on billboards and its website without the parents’ consent. The child had already transferred to another school by the time the violation was discovered. In January 2026, another school was fined KES 637,500 (~$5000) for disclosing a student’s exam results for commercial purposes. The regulator’s ruling was clear: exam results are personal data, and sharing them without consent is a violation of the law.
These cases send a direct message to school administrators across the region. Using student images in newsletters, social media posts, or promotional materials without documented, specific parental consent is not a grey area. It is a legal risk.
Nigeria and South Africa are moving in the same direction. Nigeria’s National Data Protection Commission has formed a joint working group with the Ministry of Education and is actively auditing schools for compliance. South Africa’s Protection of Personal Information Act one of the most robust data laws on the continent, requires schools to notify both regulators and affected individuals whenever a data breach occurs, with no room for delay.
The Deeper Problem: Children Are the Most Vulnerable
Behind the fines and legal frameworks sits a more fundamental issue. Children cannot meaningfully consent to how their data is used. They do not read privacy policies. They cannot negotiate with their schools. And they often have no idea that a photo taken on sports day ended up on a marketing brochure, or that their academic records were shared with a third-party platform.
Global standards including those set by the European Union and the United States already recognise this. They require organisations that work with children’s data to collect only what is strictly necessary, to carry out risk assessments before introducing new systems, and to give young people a meaningful way to protect their own information.
A recent review of digital health strategies across ten African countries found that specific protections for young people are largely absent. The same gap exists in education. Schools deploy attendance apps, learning management systems, and biometric access controls without asking a basic question: what data does this collect, where does it go, and who can access it?
There is also the infrastructure problem. Only 40% of primary schools and 50% of lower-secondary schools on the continent had internet access in 2024. Schools with unreliable connectivity face a compounded challenge, they are under pressure to adopt digital tools to stay competitive, but they often lack the technical capacity to evaluate or manage those tools safely.
What Schools Can Do Right Now
Compliance does not require a large budget or a legal team. It starts with a few concrete steps.Schools should begin by understanding what data they actually hold; student records, staff information, photos, health data, and who has access to it. They should replace vague admission forms with specific, purpose-driven consent documents that clearly explain what data will be collected and why. Any school using a third-party app or platform needs to check whether that provider complies with national data protection requirements.
Appointing a data protection officer or even a trained staff member rather than an external consultant gives the school a point of accountability. And when something goes wrong, schools need a clear plan: who to notify, how quickly, and what steps to take to contain the damage.
The continental picture is also shifting in ways that will affect schools directly. AUDA-NEPAD’s EdTech 2030 initiative is building a shared policy framework across the region, and UNESCO is working with governments on national guidelines for technology in education. Harmonised standards are coming. Schools that wait for those standards to arrive before acting are taking an unnecessary risk.
The Bottom Line
Learner data is not an administrative afterthought. It belongs to the children who generate it, and schools hold it in trust. The question is no longer whether African governments will enforce data protection in schools, the fines in Kenya and the audit requirements in Nigeria show that enforcement is already here. The question is whether schools will get ahead of it or wait to be caught.
For further reading:
African Data Protection Laws — Access Now: https://www.accessnow.org/africa-data-protection
ODPC Kenya Education Guidance: https://www.odpc.go.ke/guidance-notes
NDPC Nigeria: https://ndpc.gov.ng
POPIA South Africa: https://www.justice.gov.za/inforeg/legal.html
