Learner data and the Data Protection and Privacy Act: a guide for schools

Updated 24 October 2026

Schools hold a lot of personal data about children: names, dates of birth, photos, marks, health notes and parents’ contacts. Uganda’s Data Protection and Privacy Act, 2019 sets rules for handling it. This is a plain-word starting point, not legal advice.

Good practice for learners’ data

• Collect only what you need. If the report card does not need a learner’s date of birth or home address, the report card system should not ask for it.
• Photos with consent. Print a learner’s photo on a card only when a parent has agreed, and record that they agreed.
• Not everyone needs to see everything. A class teacher needs their own class, not the whole school. A subject teacher needs their own subject’s marks.
• Log changes to marks. Know who changed which mark, and when.
• Keep it safe. Passwords, not shared accounts; backups; and care with spreadsheets sent around on WhatsApp or flash disks.
• Keep it only as long as needed, and delete it properly when a school stops using a system.

Choosing software

Before putting learners’ data into any school system, ask:

• Can another school ever see our data?
• Can each staff member see only what their role needs?
• Can we download all our data, and delete it?
• Where is the data kept, and is it encrypted?

Where to learn more

The Personal Data Protection Office (PDPO), under NITA-U, oversees the Act and publishes guidance, including on registering as a data collector or processor. Check their current requirements for schools.