Schools hold some of the most sensitive personal data in the country — pupil records, medical information, disciplinary files, and parents' financial details. Here's what an ODPC inspection actually checks, and where most schools fall short.
Schools are classified as data controllers under Kenya's Data Protection Act, 2019 — responsible for pupil records, medical information, disciplinary files, and parents' financial details. An ODPC inspection checks whether that responsibility is actually being managed, not just assumed.
Most schools we assess fall short in the same few places:
An ODPC finding against a school carries financial penalties and, just as damaging, erodes parents' trust. A short readiness review is usually enough to identify the gaps and put a realistic remediation plan in place before an inspection — not after one.