Sukulu

Blog › Data and security

Student data protection in Africa: what every school needs to know

Marks, attendance, health, family circumstances: schools hold sensitive data about minors. African data protection laws, good practice and a simple checklist.

Sukulu Team · 18 October 2026 · 2 min

Aussi en français : Protection des données des élèves en Afrique : ce que chaque école doit savoir

A school knows a lot about its students: their identity, marks, attendance, sometimes their health, and their families' financial situation. This is personal data about minors, increasingly protected by law across Africa.

This article offers general guidance; it does not replace legal advice for your situation.

Most African countries now have a personal data protection law, often with a supervisory authority. A few examples:

  • Nigeria: Nigeria Data Protection Act 2023.
  • Kenya: Data Protection Act 2019.
  • Ghana: Data Protection Act 2012.
  • South Africa: Protection of Personal Information Act (POPIA).
  • Cameroon: Law No. 2024/017 of 23 December 2024 on personal data protection, applicable since 23 June 2026 after its transition period.
  • Senegal and Côte d'Ivoire have had data protection laws since 2008 and 2013 respectively.

At continental level, the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention) entered into force in 2023.

Details vary by country, but the principles are similar.

Common principles

  1. Purpose: collect only what serves the student's education.
  2. Minimisation: do not ask for more than necessary.
  3. Transparency: parents should know what is collected and why.
  4. Security: protect data against loss, theft and unauthorised access.
  5. Limited access: each person sees only what they need.
  6. Retention: do not keep data indefinitely without reason.
  7. Individual rights: parents can ask to see or correct their child's data.

The most common risks in schools

  • Student lists with phone numbers shared in WhatsApp groups.
  • Spreadsheets sent by email or copied to USB sticks.
  • One password shared by the whole office.
  • Report cards left where anyone can see them.
  • Student photos posted on social media without parental consent.

Checklist for your school

  • ☐ Every staff member has their own account and personal password.
  • ☐ Access is limited by role: teachers see their classes, parents their children.
  • ☐ Data is hosted by a reputable provider, with backups.
  • ☐ Sensitive access and changes are logged.
  • ☐ Parents are told how data is used (in the admission form).
  • ☐ Parental consent is obtained before publishing student photos.
  • ☐ Accounts of staff who leave are deactivated immediately.

What Sukulu does

Sukulu strictly separates each school's data: an account only reaches its own school, and each role (leadership, teacher, bursar, parent, student) sees only what concerns them. Access is enforced on the server, sensitive actions are recorded in an audit log, and traffic is encrypted. For data entered by the school, the school remains the data controller; Liafrik Tech acts as processor. Details are in our privacy policy.