Why consent matters for children’s information
South Africa’s Protection of Personal Information Act (POPIA) generally does not allow a child’s personal information to be processed unless an exception applies. The most common one for a school is the prior consent of a “competent person”, usually a parent or guardian (see sections 34 and 35 of the Act and the Information Regulator’s guidance note on children’s information). Health details and photos need particular care.
What your consent form should cover
- Who you are. The school’s name and contact details, and who your Information Officer is.
- What you collect. Contact details, date of birth, medical and allergy information, emergency contacts, photos.
- Why you collect it. Enrolment, care and safety, communication with parents, and billing.
- Who sees it. Teachers and office staff who need it, service providers that process it for you (such as software suppliers), and medical services in an emergency.
- Photos and videos, separately. Where they may appear: shared with parents in the class, newsletters and noticeboards, the website and social media. Use a separate tick box for each.
- Medical information and emergency treatment. What you may do and who you will call.
- How long you keep it. A simple retention rule, such as for as long as the child is enrolled plus the period you must keep certain records.
- Parents’ rights. To see, correct or delete information, and to withdraw consent.
- How to withdraw consent and who to tell.
- Who signed and when. Parent or guardian name, relationship to the child, signature and date.
Sample wording
Consent to process my child’s information
I, PARENT NAME, parent or guardian of CHILD NAME, consent to SCHOOL NAME processing my child’s personal information, including contact, health and emergency details, for enrolment, care, safety, communication and billing. I understand the information is shared only with the staff and service providers who need it, and with medical services in an emergency.
Photos and videos (tick what you agree to):
☐ Shared with parents of children in my child’s class
☐ In newsletters and on school noticeboards
☐ On the school’s website and social media
I understand that I can withdraw any of these consents by telling SCHOOL NAME in writing, and that I can ask to see, correct or delete my child’s information.
Signed: ________ Date: ________
Good habits that go with the form
- Keep a dated record of each consent, per child, and renew it at re-registration.
- Limit access. Teachers should only see the children in their own class.
- Keep photos off personal phones where you can, and share them only with consenting parents.
- Have a written agreement with any supplier that processes children’s information for you. POPIA requires one between a school and its operators.
- Know your Information Officer and check the Information Regulator’s guidance on registering them.
- Collect only what you need. Less information means less to protect.
General information, not legal advice. Every school’s situation is different. Speak to a legal adviser before you finalise your forms.
Keeping the records
The hard part is not writing the form; it is finding the right signed copy two years later. HiDay records consent for information and photos per child, with the date, and only shares photos with consenting parents. See how HiDay handles compliance and POPIA records.