POPIA for Schools: Photos, WhatsApp Groups and Learner Records

Why schools have it harder than most

A school holds more sensitive personal information than the average business, about people the law protects most carefully. Learner names and ID numbers, medical conditions and allergies, learning support assessments, family circumstances, disciplinary records, photographs, and the contact details of every parent and guardian.

POPIA treats a child's personal information as a special category with its own prohibition and its own narrow exceptions. That is the single most important thing for a school to understand, and it changes how you handle almost everything else.

Section 34: processing children's information is prohibited by default

Section 34 states plainly that a responsible party may not process personal information concerning a child. A child, in South African law, is anyone under 18.

That sounds impossible for a school, which is why section 35 immediately provides the exceptions. Processing is permitted where it is:

• Carried out with the prior consent of a competent person, meaning a parent or legal guardian who can consent on the child's behalf
• Necessary for the establishment, exercise or defence of a right or obligation in law
• Necessary to comply with an international law obligation
• For historical, statistical or research purposes with safeguards
• Information deliberately made public by the child with the consent of a competent person

The practical effect: a school must be able to point to which exception covers each thing it does. Enrolling a learner and keeping the records the law requires is covered by legal obligation. Putting that learner's photograph on Instagram is not, and needs parental consent.

Public schools and independent schools are treated differently

This catches people out. Under the Promotion of Access to Information Act, a public school is a public body, while an independent or private school is a private body.

Both must comply with POPIA. The difference matters for PAIA: private bodies must compile a section 51 PAIA manual, and the exemption that once covered smaller organisations expired on 31 December 2021. If you run an independent school and have never produced one, you need one.

Both types must also designate an Information Officer. In a school that is the principal by default, and the role must be registered with the Information Regulator.

Photographs: the question every school gets asked

A facial image can be biometric information, which is special personal information under section 26. Combined with the section 34 prohibition on children's data, photographs deserve real thought rather than a line buried in the enrolment form.

A workable approach that most schools can defend:

• Separate the purposes. A photo on a class list for internal identification is different from a photo on the school's public Facebook page, which is different again from a photo sold to a stock library. Consent for one is not consent for the others.
• Ask specifically, and let parents say no to some and yes to others. A single "we may use photographs" tick box bundled into enrolment is exactly the bundled consent POPIA does not accept.
• Make it withdrawable. Section 11(2)(b) lets a parent change their mind. You need a way to record that and act on it, including removing images already published where you reasonably can.
• Be careful with names. Publishing a photograph with a full name, a grade and a school identifies a specific child to anyone who sees it. Many schools now publish first names only, or no names.
• Remember matric and 18th birthdays. Once a learner turns 18 they consent for themselves, and the competent person's consent no longer governs.

Parent WhatsApp groups

Class WhatsApp groups are near-universal in South African schools and they are a genuine POPIA issue, because adding someone to a group discloses their phone number to every other member.

Where the school creates and administers the group, the school is processing that personal information. Points worth getting right:

• Tell parents at enrolment that a class group exists, what it is for, and that joining means other parents will see their number. Let them opt out without penalty.
• Use the group for what you said you would use it for. A group created for logistics being used to circulate a learner's disciplinary situation is a disclosure the school will struggle to defend.
• Discourage staff from using personal devices and personal numbers for school communication where you can. When a teacher leaves, the school cannot control what remains on their phone.
• Consider broadcast-only channels for announcements, which do not expose members to each other.
• Never circulate learner photographs, medical information or addresses in a parent group.

Learner records and how long to keep them

Section 14 says do not keep records longer than necessary, unless another law requires it. Schools are squarely in the "another law requires it" category: the South African Schools Act and provincial education regulations set retention obligations for admission registers, attendance records and academic results, and some must be kept permanently or for many years.

The practical approach is to write down, per record type, why you hold it and for how long:

• Statutory records such as the admission register: keep for the period the law requires, and no less
• Academic records: long retention is justifiable, since former learners request results and transcripts for years
• Medical and support records: sensitive, and should be accessible only to staff who need them, not the whole staffroom
• Photographs and marketing material: tied to the consent given, and deleted when consent is withdrawn or expires
• Applications from learners who never enrolled: the purpose ended. Delete them.
• CCTV footage: usually days or weeks, not years, unless it is needed for a specific incident

Our data retention guide covers the general rules.

School apps, portals and third-party providers

Most schools now run a communication app, a fee management system, a learning platform and cloud storage. Every one of those providers is an operator processing learner information on the school's behalf, and section 21 requires a written contract with each of them.

Two further questions worth asking any provider before you sign:

• Where is the data stored? If it leaves South Africa, section 72 applies and parents should be told.
• What happens to the data if we leave? You want deletion on termination in writing, not a vague assurance.

See operator agreements for what those contracts need to contain.

When something goes wrong

Section 22 requires notifying both the Information Regulator and the affected people as soon as reasonably possible after a compromise. For a school that includes a lost staff laptop with learner records on it, a class list emailed to the wrong parent, or a portal breach.

Notifying parents about their own children's information is uncomfortable, but the obligation is not discretionary. Our breach response guide sets out the order to do things in.

Where to start

Schools rarely have a compliance officer, so the realistic first steps are:

• Register your Information Officer with the Regulator
• Rewrite the consent section of your enrolment form so photograph permissions are separate, specific and withdrawable
• Publish a privacy notice for parents, in plain language
• Independent schools: compile your PAIA manual
• List every third-party system holding learner data, and get contracts in place

POPIA Ready generates a privacy policy, a PAIA manual and five other documents customised to your organisation, free to preview. The free checklist will tell you what else is missing.

General guidance on the Act as at July 2026, not legal advice. Schools also operate under the Schools Act, the Children's Act and provincial regulations, and specific situations deserve a professional opinion.