Is your private school marketing unlawfully exploiting students’ personal data?

Take a quick look at your school’s digital footprint. Your latest YouTube video shows the swimming gala. Your Facebook page proudly displays top performers with their grades. TikTok features snippets of the school presidential campaign. The website header is a high-resolution photo of smiling students in the newly built science lab. To the school management team, this looks like brilliant social media marketing. It showcases academic excellence, leadership skills, infrastructure and active extra-curricular engagement.

According to the Office of the Data Protection Commission, the regulator, publishing student names, images or academic results to promote a school’s reputation constitutes processing personal data for commercial benefit. The main question is whether you are processing data lawfully. Only parental consent applies to school promotional marketing. Consent must be freely given, specific, informed and unequivocal. It must be explicitly expressed by the child’s parents or guardians.

A common oversight made by schools is relying on standard admission waivers, which creates massive legal exposure. When the regulator issues multi-million shilling penalties for processing children’s data without a lawful explanation, it sends a clear message to the school’s directors. The law treats children’s data with heightened protection because minors lack the legal capacity to give informed consent.

Once an image enters the internet, control is permanently lost. An innocent video of a drama festival or music performance can be downloaded, manipulated, or scraped by data-harvesting algorithms.

Minors are highly vulnerable to online profiling, privacy violations and identity theft. As data controllers and data processors, schools have a duty to safeguard the dignity and privacy of their students. School directors must move from passive compliance to active verification of their data protection policies. This shift mitigates substantial financial and reputational risks.

Parents must have options to opt in and opt out. Train your marketing department, ICT staff, and external photographers. They must know that capturing a child’s image is not automatic. Enrollment does not grant a school automatic digital rights.

Ensure you have a lawful reason for processing student data.