In 2024, Roma School in Uthiru was fined Sh4.55 million by the Office of the Data Protection Commissioner for publishing a minor’s image without parental consent.
Parents across Kenya have in the recent past taken legal action against schools for privacy breaches, unauthorised use of their children’s images in marketing materials and failure to protect student data.
Now, with this new wave of young teachers filming TikTok dance challenges in classrooms, posting day-in-the-life vlogs featuring their students, and building social media followings using school content, where does the law draw the line?
Mary Audi, Senior Associate Advocate, and Fridah Muriithi, Associate Advocate, both from Mweni Njuguna & CO Advocates, weigh in on the legal complexities surrounding this debate.
“The Constitution of Kenya guarantees the right to privacy under Article 31 and further provides under Article 53 that the best interests of the child are of paramount importance in every matter concerning the child,” she explains. This constitutional framework is reinforced by the Children Act 2022, which imposes a legal duty on all persons and institutions to safeguard children from abuse, exploitation and harmful exposure.
Ms Audi says the Data Protection Act 2019 plays a central role in regulating how personal data, including images and videos of children, may be collected, processed and shared.
“The Act requires that such processing be lawful, fair and transparent, and imposes heightened safeguards where minors are involved,” she says. These protections are further complemented by the Basic Education Act, which imposes a statutory duty of care on schools, and the Computer Misuse and Cybercrimes Act, which addresses unlawful online conduct.
On whether teachers are legally allowed to record students in school settings, Ms Audi clarifies that the answer is not a simple yes or no.
“There is no absolute prohibition on recording students, particularly where it serves legitimate educational purposes such as classroom assessment, instructional use, internal documentation or safeguarding,” she says.
However, such recording must be undertaken within the framework of an established school policy and in compliance with applicable data protection principles.
The law requires that any personal data relating to a minor be processed lawfully, including obtaining appropriate consent from a parent or legal guardian.
“Processing must be carried out in a manner that protects and advances the rights and best interests of the child,” Ms Audi emphasises. Such consent cannot be inferred, implied or embedded in generic admission forms or broad institutional policies.
When it comes to parental consent for minors appearing in social media content, Ms Muriithi is absolute about the legal requirements.
“Kenyan law adopts a highly protective approach to consent involving minors,” she says.
Under the Data Protection Act, children are not considered capable of giving legally valid consent. Consequently, any use of a child’s image or video, particularly in a public forum such as social media, requires the informed, specific and voluntary consent of a parent or legal guardian. General enrolment forms, broad school policies or general notices do not meet this legal threshold.
“The ODPC's 2025 Guidance Notes further clarify that parental consent must amount to explicit permission specifically directed at the intended processing of the child's personal data,” Mary explains.
In practical terms, the casual posting of children's images on platforms such as TikTok without parental consent is unlawful.
Even where consent is obtained, the content must still satisfy the overarching requirement that it serves the child's best interests and preserves their dignity and welfare.
Addressing who bears legal responsibility when a child's image is shared online without permission, Mary makes clear that accountability is both direct and sometimes shared.
“Legal responsibility primarily rests with the individual who records or shares the content, particularly where that person determines the purpose and manner of processing,” she says.
Under the Data Protection Act, such an individual may be classified as a data controller or processor and is directly accountable for any unlawful processing.
Where a school publishes the content, the school itself bears liability. Where a teacher independently posts the content on a personal account, that teacher assumes personal liability as an independent data controller.
“However, liability does not necessarily end there. A school may also be held responsible where the act occurs within the course of employment or where it has failed to implement adequate safeguards and policies to prevent such conduct.” She notes.
Mary outlines the serious consequences awaiting those who violate these laws. “Under the Data Protection Act, offenders may be liable to administrative fines of up to Sh5 million or one percent of annual turnover, whichever is higher, in addition to potential compensation claims from affected individuals.”
Building on this legal foundation, Fridah Muriithi shifts the focus to how these laws apply in the real world of social media platforms like TikTok.
“The Children Act and the Data Protection Act operate concurrently and are fully applicable to social media platforms such as Tiktok,” she explains. The Children Act focuses on safeguarding the child's dignity, welfare and protection from exploitation, while the Data Protection Act regulates the legality of collecting and sharing the child's personal data, including images and videos.
In practice, this means that a teacher or any other individual who posts a child's image on social media without proper consent breaches data protection laws. If the content further exposes the child to harm, embarrassment or exploitation, it also violates the protections under the Children Act.
“The informal nature of social media does not exempt users from compliance, rather, it heightens the need for caution given the speed and scale at which content can spread,” Advocate Muriithi cautions.
On whether schools have the authority to ban recording and content creation on their premises, Muriithi is emphatic. “Schools are fully entitled to impose restrictions on recording, livestreaming and content creation within school premises,” she affirms.
This authority arises from their statutory duty of care under the Basic Education Act, their obligations as data controllers under the Data Protection Act, and the overarching requirement to act in the best interests of the child.
A school that permits unregulated recording risks breaching its own obligations as a data controller by failing to implement adequate safeguards for the protection of learners' personal data. “Schools not only have the right but also a legal and institutional duty to regulate and, where necessary, prohibit such activities, particularly where external publication is intended,” she says.
From an ethical and professional standpoint, Advocate Muriithi addresses where the line should be drawn regarding social media content involving learners.
“While the law provides a minimum threshold, ethical and professional standards require a more cautious and child centred approach,” she observes. Schools and teachers must recognise the inherent imbalance of power between adults and learners and avoid any conduct that may exploit that relationship for personal gain, including social media visibility or branding.
The line is crossed wherever content risks undermining a child's dignity, privacy or long term wellbeing. “Even content that appears harmless in the moment may have lasting consequences once shared widely or permanently online,” she warns. The guiding principle should always be whether the content genuinely serves the child's interests, rather than the interests of the adult.
Muriithi also highlights the considerable risks facing young teachers and student teachers who post school related content online. “Young teachers and student teachers face significant legal, professional and reputational risks when engaging in social media content involving learners,” she states.
These include potential liability under data protection and child protection laws, disciplinary action by the Teachers Service Commission, and in serious cases, deregistration from the teaching profession.
A single finding of misconduct relating to student privacy may permanently affect one's career in education. There is also the risk of reputational harm, which can be immediate and long lasting in the digital age.
“The permanence of online content means that posts may resurface years later, often in unintended or damaging contexts,” she adds. Even well-intentioned content may be misinterpreted, exposing both the teacher and the learner to unnecessary scrutiny.
In her final assessment, Advocate Muriithi states that the primary challenge lies not in the adequacy of the law, but in its implementation, awareness and enforcement.
“Many educators and institutions still lack a clear understanding of how data protection and child protection principles apply in everyday school environments, particularly in relation to social media.”
While enforcement mechanisms exist, they are still evolving, and there is a growing need for more sector specific guidelines, particularly tailored to schools. Enhanced sensitisation and training are also necessary to ensure that educators can responsibly navigate the realities of the digital age.
