Data protection notice
Last updated 26 September 2026
How SIIQ meets Kenya’s Data Protection Act 2019 for children’s data: consent, your rights, and what happens if something goes wrong.
Draft — pending legal review
The law that applies
SIIQ holds records about children, so the Data Protection Act, No. 24 of 2019, and the Data Protection (General) Regulations, 2021, apply. A child is anyone under 18, and SIIQ treats every pupil under 18 as a child.
Registration with the Office of the Data Protection Commissioner (ODPC): [Registration status and number — to be confirmed].
Consent from a parent or guardian
A pupil’s data is processed only when their parent or guardian has consented. SIIQ works out whether a pupil is under 18 from their date of birth.
- Each purpose has its own consent. For example, a guardian can say no to photographs without withdrawing the pupil’s whole record.
- Every consent and every withdrawal is kept as a dated record, showing who decided and who entered it, so the school can prove how and when consent was given.
- When school staff record a paper consent form, SIIQ records that staff member as entering it and never claims the guardian acted in the app.
- Until consent is recorded, a pupil appears in lists marked as awaiting consent, and nothing can be recorded against them.
Withdrawing consent
A parent or guardian can withdraw consent at any time. Processing covered by that consent stops. Withdrawal does not make earlier processing unlawful if it was lawful when it happened.
Your rights and how fast we answer
- See what is held: within 7 days.
- Correct it, object to its use, restrict it, or have it deleted: within 14 days.
There is no fee. To make a request, contact your school or [Data protection contact — to be confirmed].
How children’s data is protected
- Every school’s data is kept apart. A request for another school’s record is answered as if the record does not exist.
- Every access to a child’s record is logged against the person who made it.
- SIIQ staff can view a school’s records only read-only, and the school sees a banner while they do.
- County and national bodies see counts only. Counts below 10 are withheld (this can be set per institution between 5 and 30), and a second count is withheld where the first could be worked out by subtraction.
If something goes wrong
A data breach is reported to the ODPC within 72 hours of SIIQ becoming aware of it. [How affected schools and families are told — to be confirmed]
Complaints
Contact [Data Protection Officer contact — to be confirmed] first. You also have the right to complain to the Office of the Data Protection Commissioner.