“Compliance is the highest form of appreciation. A school that builds data consent into how it celebrates academic milestones will lose absolutely nothing in public pride, but will gain a great deal in parental trust.” Data Protection Act, 2019: Children Act, 2022: Article 31, Constitution of Kenya
Introduction
On this World Teachers’ Day, Wamae & Allen LLP honours the men and women who shape Kenya’s learners long before the world takes notice of them. Teaching has always carried a duty of care. In 2026 that duty extends to something a teacher cannot see but handles daily: a learner’s personal data. A results list, a prize-giving photograph and a classroom video clip each say something about a child, and the law now asks schools to treat each of them with the same care they give the child in person.
The Legal Position in Brief
Under the Data Protection Act, 2019 (the Act), a school that determines why and how learners’ information is used is a data controller. A learner’s name, admission number, grades, photograph and video are personal data.
Section 33 of the Act subjects a child’s data to a higher standard: processing requires the consent of a parent or guardian and must be carried out in a manner that protects and advances the rights and best interests of the child. This sits on the right to privacy under Article 31 of the Constitution and the paramountcy of the child’s best interests under Article 53(2) and Section 8 of the Children Act, 2022.
The consequence is a quiet but significant shift. Celebrating a learner is lawful whereas publishing a learner is a regulated act. Admission forms with broad “media clauses” are unlikely to suffice, because consent under the Act must be specific, informed and capable of withdrawal.
Where Schools Commonly Go Wrong
- Results banners and newspaper adverts: naming learners alongside marks to market the institution, where the dominant beneficiary is the school, not the child.
- Staff WhatsApp groups and statuses: informal sharing of class lists, marks or photographs that then circulate beyond the school’s control.
- Social media content: TikTok and Facebook clips of learners, often with uniforms and location details that make them easy to identify and trace.
- Underperformance disclosures: ranked lists read aloud or posted publicly, which can humiliate and expose a child to bullying.
For Schools: A Five-Point Compliance Checklist
| Action | Why it matters |
| Use a stand-alone media and results consent form | Consent buried in admission terms is unlikely to be specific or freely given. |
| Separate results consent from image consent | A parent may accept one and refuse the other; the form must allow both choices. |
| Apply a best-interests test before every publication | Section 33 and Section 8 require the child’s interest, not institutional marketing, to lead. |
| Set a staff device and messaging policy | Most leaks occur through personal phones and WhatsApp, not official channels. |
| Keep a withdrawal and takedown procedure | Consent may be withdrawn at any time; the school must act on it promptly. |
Conclusion
The best teachers already know that a child’s achievements are the child’s to share. The law has now caught up with that instinct. Schools that build consent into how they celebrate will lose nothing in pride and gain a great deal in trust.
We appreciate all teachers and may this year’s celebrations be as careful as they are joyful.
Wamae & Allen LLP advises schools, education boards and parents on data protection compliance, consent frameworks, staff policies and ODPC complaints and defence.
Disclaimer: This update is for general information only and does not constitute legal advice. For advice on your specific circumstances, please contact the W&A Data Protection & ICT Law Department; WAICTLaw@wamaeallen.com .
