School data

Agree the processing before the data arrives.

Institutional implementation separates commercial enquiries, curriculum material, school content and any learner information. The applicable roles and written safeguards depend on the actual workflow.

Six questions for every data element.

Why is it necessary? Who may access it? How long is it retained? Where is it stored? Who processes it? When and how is it deleted? A data schedule answers these questions for the actual service. Health, religion, politics, biometrics, family problems, disciplinary history and emotion notes are not default academic fields.

Responsible party and operator.

Where a commercial operator processes information for a school, determine the actual POPIA roles and document the authorised instructions, confidentiality and security arrangements, including sections 19–22 where applicable. The school’s obligations and the operator’s duties are not replaced by a generic website declaration. Children’s and special-information rules are assessed separately.

Providers, borders and incidents.

Record each approved provider’s service, data categories, location, access, retention, deletion, contractual safeguards and any subprocessor. Assess POPIA section 72 transfers and prior-authorisation requirements where relevant. Restrict access and notify the responsible party promptly after a suspected compromise; statutory section 22 notification responsibilities remain applicable.

A documented institutional implementation.

Prepare a school data-processing addendum, operator terms, subprocessor register, retention schedule, incident procedure, data-subject request process and child-data procedure. Populate the documents with verified parties and real services, then have them reviewed before execution. Blank schedules are internal preparation, not signed contracts or proof that safeguards are already operating.

Exit and data return.

Agree export formats, rights to original school content, access termination, return or deletion, lawful holds and backup treatment. Do not promise immediate deletion from every provider without confirming the technical and contractual facts. Preserve only what a lawful purpose or requirement justifies.

Legal references and practical scope

Applicable South African law, school policy, permissions and the actual facts control each implementation. These notices do not create consent, certification or a statutory exception. They do not constitute legal advice.

Official references checked on 7 October 2026. Links identify requirements and rights; this site does not host their teaching collections.

Start with a defined scope

One teaching need is enough to begin.

Tell us the school context, curriculum, grades and subject. We will clarify the work and commercial basis before implementation.

Request a formal proposal