A headteacher's guide to school fee collection compliance under Kenya's Data Protection Act

By Jaydee Innovation Hub · 7 min read

Collecting school fees means handling sensitive data: parent phone numbers, M-PESA transactions, and each learner's financial record. Under Kenya's Data Protection Act 2019, how you store and process that data matters. Here is a practical guide for headteachers and bursars.

What the Data Protection Act asks of schools

The Act treats a school as a data controller: you decide why and how personal data is processed, and you are accountable for keeping it safe, using it only for stated purposes, and giving parents rights over their data. Fee records, admission numbers and payment histories all count.

Where your data lives is the first decision

The single biggest compliance choice is where the data is stored. Systems that push your records to a shared public cloud move sensitive data off your premises and often out of the country. Running your management system on the school's own server keeps data on-site and under your control — a much cleaner position under the Act.

Minimise, secure and control access

Collect only what you need, restrict who can see financial records, and keep an audit trail of who did what. Role-based access and an immutable log are not just good practice — they are what you point to if a parent or the regulator ever asks how data is handled.

M-PESA data and reconciliation

When parents pay by M-PESA, the transaction data should flow straight into the correct learner's ledger without staff copying numbers into spreadsheets. Fewer manual touchpoints means fewer places sensitive data can leak.

A simple compliance checklist

Store fee data on your own server; limit access by role; keep an audit trail; collect only necessary parent details; and be able to show a parent their record on request. If your current system can't do these, it's worth reviewing.

How Elimu SMS helps

Elimu SMS runs on your school's own server, with role-based access, an immutable audit trail, and native M-PESA reconciliation — so fee data stays on your premises and under your control, in line with the Data Protection Act 2019. See the on-premise comparison for why this matters.