Every day, your preschool collects information about children and their families: names, birth dates, ID numbers, allergies, photos, emergency contacts. In South Africa, the law that governs how you handle that information is the Protection of Personal Information Act, known as POPIA.
This guide explains what POPIA means for a preschool principal in plain language. It is general information, not legal advice, so check anything specific to your situation with the Information Regulator or a legal professional.
Why POPIA applies to your preschool
POPIA applies to anyone who keeps personal information about people, including schools, ECD centres and home-based preschools. The Act has been fully in force since 1 July 2021, so there is no grace period left.
Personal information is anything that identifies a person. At a preschool that includes:
- Children’s names, birth dates, photos and ID or birth certificate numbers
- Parents’ names, addresses, phone numbers and email addresses
- Fee and payment records
- Staff records
Some of what you hold is more sensitive. Information about a child’s health, such as allergies, medication or a diagnosis, is treated as special personal information and needs extra care.
Children get extra protection
POPIA treats anyone under 18 as a child. As a general rule, you may only process a child’s personal information with the consent of a parent or guardian, or where another lawful reason applies, such as a legal obligation.
In practice, that means getting clear written consent on your registration form for what you collect and why, and asking for separate consent for extras such as photos on social media.