Data protection for Nigerian schools: the basics

What data a school holds

• Students: names, dates of birth, photos, results, attendance, discipline
• Sensitive records: health, allergies, special needs, counselling notes
• Parents: names, phone numbers, addresses, payment records
• Staff: contact details, bank details, salaries, tax and pension numbers

Health and similar records are sensitive personal data under the NDPA and need extra care.

The principles in plain words

• Collect only what you need, for a clear reason
• Tell parents and staff what you collect and why (a privacy notice)
• Get consent where it's needed, from a parent for a child
• Keep it accurate, and only as long as you need it
• Keep it secure, and limit who can see it
• Let people see and correct their own data

Practical steps for a school

1. 1List what you collect, where it's kept and who can see it.
2. 2Write a short privacy notice for parents and staff.
3. 3Limit access by role: a subject teacher doesn't need counselling notes or salaries.
4. 4Stop sharing children's data in open WhatsApp groups and unlocked Excel files.
5. 5Make sure your software provider protects the data and has signed a data processing agreement with you.
6. 6Name someone responsible for data protection, and know what to do if data leaks.

What to ask your software provider

• Is the connection encrypted, and are passwords stored safely?
• Can we control who sees what, by role?
• Is there a log of who changed what?
• Is each school's data kept separate?
• How is data backed up, and can we export it?
• Will you sign a data processing agreement?

How Qyskul protects school data

Qyskul uses encrypted connections and hashed passwords, and our own team can only open the platform console with two-factor sign-in. Each school's data is kept separate, every role sees only what it needs, sensitive records such as health and counselling are limited to the staff who need them, and changes are logged. Read our security page for details.

Questions