Every school holds personal information about children and their families: names, dates of birth, addresses, phone numbers, photographs, health notes, results and fee records. That is a lot of trust. Nigeria has a data protection law, the Nigeria Data Protection Act 2023, which sets rules for anyone who handles personal information, including schools.
This post is general guidance and not legal advice. If you need a firm opinion for your school, speak to a qualified lawyer, and check the guidance from the Nigeria Data Protection Commission. Here is what responsible care looks like in everyday school life.
1. Only collect what you need
Before you ask a parent for a piece of information, ask yourself why the school needs it. A name, a class, a parent's phone number and an address are usually needed. A parent's salary or a child's religion may not be. The less you collect, the less you have to protect.
2. Tell parents what you do with it
Have a short statement, in simple words, that tells parents what you collect, why, who sees it and how long you keep it. Put it on the admission form and on the school website. A parent who is told clearly is far more likely to trust you.
3. Photos of children need care
Photos on the school website, social media or notice boards are a common concern. A sensible approach:
- ask for a parent's permission on the admission form, with a separate yes or no for photos,
- do not post a child's full name next to their photo,
- take down a photo promptly when a parent asks,
- never post a photo of a child in a vulnerable situation.
4. Control who can see what
Not everyone needs to see everything.
- A teacher needs to see the pupils and subjects they teach, not the school's finances.
- A bursar needs fee records, not health notes.
- A parent should see only their own children.
If you use software, check that it separates access by role. In StudyPat, a teacher sees their own subjects, and a parent sees only the children linked to them.
5. Never share passwords
A shared login means nobody is accountable, and it means a former employee may still have access. Every person should have their own login, and a password that only they know. Where a school once gave parents a common starting password, it is a risk, because any one of them could open another family's records. A personal set-password link is safer.
Use strong passwords, do not write them on a wall, and remove access as soon as someone leaves.
6. Keep paper safe too
Paper records are data as well. Keep admission files, health notes and old results in a locked cupboard. Do not leave a register on a desk where visitors can read it.
7. Back up, and store the backup safely
Data that you cannot recover is data you have lost. Back up your records regularly, and keep a copy away from the school premises. Protect the backup too, because a stolen backup is as bad as a stolen file.
8. Be careful with WhatsApp and phones
Staff often share class lists and results in WhatsApp groups. This is convenient but risky. A few simple rules help:
- share only what the group needs to know,
- never post one child's results, fees or health details in a group,
- use a separate school phone or account where possible,
- lock phones and remove staff from groups when they leave.
9. Choose software and suppliers carefully
When you give pupil data to a software provider, ask:
- Where is the data stored, and who can see it?
- Is it backed up?
- Can I get my data out if I leave?
- Does the provider have a clear privacy policy?
You remain responsible for the data you collect, even when someone else stores it for you.
10. Know what to do if something goes wrong
If a laptop is lost, a file is stolen, or a login is misused, act quickly:
- Find out what was exposed.
- Change affected passwords and cut off access.
- Tell the head and, where required, the affected parents and the regulator. Check the current rules on timing.
- Write down what happened and what you changed.
11. Keep records only as long as you need them
Old records are a risk. Decide how long you keep each type of record, and destroy what you no longer need in a safe way. Results and transcripts are usually kept for many years, while a copy of a rejected application can usually go sooner.
12. Give someone the job
Name one person to be responsible for data protection in the school, even if it is part of their role. Train staff once a year in a short meeting.
A short checklist
- We only collect what we need.
- Parents are told how we use their information.
- Photo permission is asked separately.
- Everyone has their own login and password.
- Teachers and parents see only what they should.
- Backups exist, off site.
- Staff know the rules for WhatsApp and phones.
- Someone is named to look after data protection.
You do not need to be perfect on day one. Start with the logins, the backups and the photo permissions, and improve each term.
Frequently asked questions
Does the Nigeria Data Protection Act apply to schools?
The Act sets rules for anyone who handles personal information, and schools hold a lot of it about children and their families. This guide is general advice and not legal advice, so speak to a qualified lawyer if you need a firm opinion for your school.
Can a school post pupils' photos online?
With care. Ask for the parent's permission on the admission form, with a separate yes or no for photos, do not post a child's full name next to their photo, and take a photo down promptly when a parent asks.
Who should be able to see pupil records?
Only the people who need them. A teacher needs their own pupils and subjects, a bursar needs fee records, and a parent should see only their own children. In StudyPat, a teacher sees their own subjects and a parent sees only the children linked to them.
Is it safe to share results in WhatsApp groups?
It is risky. Share only what the group needs to know, and never post one child's results, fees or health details in a group. Fee matters especially should be handled privately, as in how to reduce school fee defaulters.
What should a school do if pupil data is lost or exposed?
Find out what was exposed, change affected passwords and cut off access, tell the head and, where required, the affected parents and the regulator, and write down what happened and what you changed. Check the current rules on timing.
If you want to keep your records in one safe place with separate logins for staff and parents, you can start free with StudyPat and set up your first class in a few minutes.