POPIA for preschools: what every principal should know
Every day, your preschool collects information about children and their families: names, birth dates, ID numbers, allergies, photos, emergency contacts. In South Africa, the law that governs how you handle that information is the Protection of Personal Information Act, known as POPIA. This guide explains what POPIA means for a preschool principal in plain language. It is general information, not legal advice, so check anything specific to your situation with the Information Regulator or a legal professional. Why POPIA applies to your preschool POPIA applies to anyone who keeps personal information about people, including schools, ECD centres and home-based preschools. The Act has been fully in force since 1 July 2021, so there is no grace period left. Personal information is anything that identifies a person. At a preschool that includes: Some of what you hold is more sensitive. Information about a child’s health, such as allergies, medication or a diagnosis, is treated as special personal information and needs extra care. Children get extra protection POPIA treats anyone under 18 as a child. As a general rule, you may only process a child’s personal information with the consent of a parent or guardian, or where another lawful reason applies, such as a legal obligation. In practice, that means getting clear written consent on your registration form for what you collect and why, and asking for separate consent for extras such as photos on social media.