South African schools and universities

Compliance and data protection for education.

Admissions, results, fee accounts and support records need to remain available to the right people. Protect learners, students and staff while keeping the records needed to teach, assess and administer the institution.

The regulatory context

Start with the institution and the information it holds.

A public school, independent school, public university and private higher-education institution do not have identical duties. Some university students are also children for POPIA purposes. Establish the applicable rules before selecting controls.

POPIA and children

Identify the lawful purpose for each use.

POPIA sections 34–35 restrict the processing of children's information and set out exceptions. Prior consent from a competent person is one route; a qualifying legal obligation can be another. A general parental consent form does not authorise every later use.

Health, counselling, disability and biometric information also need assessment under the special-personal-information provisions. Restrict access according to the purpose and the person's role.

Sources: POPIA; children's information guidance.

Schools Act

Distinguish public-school duties.

The South African Schools Act, including the BELA amendments, sets specific public-school financial record and reporting duties in sections 42–43. These involve the governing body, not only the finance software provider.

Independent schools operate under a separate framework. Confirm applicable education, provincial and examination requirements rather than copying a public school's checklist.

Sources: Schools Act, as amended.

Higher education

Keep governance and reporting responsibilities clear.

The Higher Education Act distinguishes public institutions from registered private providers. Public-institution reporting regulations address council oversight of IT governance, risk and controls; private institutions have their own registration and reporting requirements.

The registrar, finance, academic and research functions should identify the records their duties require. An IT service can support that work, but cannot establish accreditation or academic compliance.

Sources: Higher Education Act; public higher-education reporting regulations; DHET policy repository.

This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.

Keep what is required, for the right reason

Use a schedule that distinguishes academic and administrative records.

There is no single retention period for every school or university file. Map each category to applicable law, education and examination rules, contracts and the institution's approved policy.

Selected records to include in your retention schedule
Record category	Rule or decision to confirm	Useful evidence
Admissions, assessment and academic results	Have the responsible academic or records function confirm the required record, retention trigger and access rules. Distinguish working assessment material from the official academic record; do not purge both at the end of a term or course. Sources: Schools Act, as amended; Higher Education Act; POPIA.	Approved schedule, named record owner, controlled final results and a retrieval test.
Learner and student support information	Keep health, counselling and other sensitive records under restricted access for a lawful purpose and justified period. Confirm the applicable professional, safeguarding and legal-hold requirements before disposal. Sources: POPIA; children's information guidance.	Documented purpose, access approvals, retention decisions and authorised disposal records.
Public-school financial records	Sections 42–43 address financial records, statements and reporting. Map those duties to the supporting transactions and documents. These sections are not a blanket retention period for every school record; check other applicable requirements separately. Sources: Schools Act, as amended.	Accessible transaction history, supporting documents, reporting copies and restore checks.
University administration and research	Identify statutory, reporting, funder, contractual and approved research requirements by record category. Neither a cloud account's default retention nor an academic year-end is sufficient authority to erase the record. Sources: Higher Education Act; DHET policy repository; POPIA.	Registrar or research-owner approval, applicable terms, access reviews and an exit/export plan.

A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.

From risks to working controls

Protect the information used in everyday teaching and administration.

These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.

Shared devices expose another person's records

Separate staff, learner and administrative access. Review shared lab devices, saved passwords and privileged accounts. Assess multi-factor authentication for staff and administrative systems, with suitable recovery arrangements.

Possible evidence: Account inventory, access reviews, device settings and approved exceptions.

Information reaches the wrong parent, student or supplier

Verify identity and authority before releasing records. Do not assume a parent may access an adult student's information. Review class lists, bulk email, messaging groups and supplier access for unnecessary disclosure.

Possible evidence: Release procedure, approved access roles and a record of sensitive disclosures.

Results change without a trace

Restrict who can capture, amend and approve results. Preserve change history and final approved versions. Agree the academic owner who checks a restored result set before it is used.

Possible evidence: Permissions, approval history, dated result versions and validation of a test restore.

Teaching or administration cannot resume after data loss

Confirm backup coverage for the learning platform, student administration, finance systems and shared files. Include databases, attachments and supplier dependencies. Test representative recovery against agreed priorities, including periods of unreliable power or connectivity.

Possible evidence: Coverage and exclusions, recovery plan, test results and unresolved actions.

Accounts remain active after a person leaves

Coordinate staff departures, contractor access and learner or student account changes. Preserve records that must remain available before accounts or licences are removed. Check what the institution can export when a platform contract ends.

Possible evidence: Leaver approvals, retained-record checks and tested exports.

The control examples draw on POPIA and NIST CSF 2.0. Technical guidance is not itself South African legislation or a compliance certificate.

What to check

Check education platforms before sending information abroad.

Identify what an education app collects, who receives it, where it is processed and how the institution can retrieve or delete it. POPIA section 72 governs transfers to foreign recipients; South African hosting alone does not settle every processing duty.

Sections 57–58 can also require prior authorisation for transfers of children's or special personal information to a foreign third party without adequate protection. Have the Information Officer assess the actual arrangement before processing begins. The linked Regulator guidance explains this separate requirement.

Prepare before an incident

Include learner and student information in the incident plan.

A lost device, exposed class list or compromised staff account needs prompt assessment of the information and people affected. Escalate through the institution's agreed IT and Information Officer contacts. Where learner welfare is involved, include the responsible safeguarding staff without circulating sensitive details more widely.

Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.

Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.

Bastion Backups' role

Agree coverage for the systems the institution relies on.

Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.

Confirm platform compatibility and supplier permissions before including a learning platform, student system or hosted application. The scope should state what can be recovered, who validates academic or financial records and which supplier actions remain necessary.

Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.

The institution retains decisions on admissions, assessment, research ethics, lawful processing, retention and regulatory reporting. Governing bodies, councils and appointed staff retain their statutory and professional roles. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.

Explore our supported solutions

Common questions

Decisions to make before selecting a service.

Does POPIA require parental consent for every learner record?

No. Sections 34–35 provide specific exceptions for children's information, including competent-person consent and qualifying legal obligations. Establish the lawful ground for the particular purpose, minimise collection and explain the use. Consent for one purpose does not automatically extend to another.

Does a hosted learning platform replace a backup plan?

Confirm the platform's retention, deletion recovery, export and restoration terms. A supplier's availability commitment does not necessarily provide the institution with an independent recoverable copy. Agree suitable coverage and test what is actually recoverable.

Must all academic records be kept for seven years?

There is no single seven-year rule covering every academic record. The institution must confirm the period and trigger for each category under its applicable rules, contracts and approved schedule. Avoid deleting an official results record simply because a shorter working-file period has expired.

Legislation and guidance

Check the source and its scope.

Content reviewed 16 October 2026.

Protection of Personal Information Act 4 of 2013 — sections 14, 19–22, 26–33 and 72: retention, safeguards, operators, incidents, special personal information and cross-border transfers.
Information Regulator: processing personal information of children — POPIA sections 34–35; the prohibition, lawful exceptions and competent-person consent. Consent is not the only permitted ground.
Information Regulator: prior authorisation — POPIA sections 57–58, including certain transfers of children's or special personal information to foreign third parties without adequate protection. Read with section 72.
DBE: South African Schools Act 84 of 1996, incorporating BELA amendments — DBE consolidated text updated to 24 December 2024. Sections 42–43 concern public-school financial records and reporting; independent schools have a separate statutory framework.
Higher Education Act 101 of 1997 — public higher-education governance and the registration framework for private higher-education institutions; institution-specific rules and applicable regulations also matter.
Regulations for Reporting by Public Higher Education Institutions, 2014 — GN R.464, Gazette 37726. Public-institution reporting includes council oversight of IT governance, risk and controls. The illustrative report is not a universal technical specification.
DHET: Higher Education Act policy repository — official links to public-institution reporting and private-institution registration regulations and reporting material. Confirm the instrument applicable to the institution.
Information Regulator: handling security compromises — notification roles and reporting process; read with POPIA sections 21 and 22.
NIST Cybersecurity Framework 2.0 — voluntary guidance for risk management, access, protection, recovery and evidence; not South African legislation.

Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.

View all industry guides

Discuss your education systems

Begin with the records needed to keep the institution working.

Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.

Email us Call +27 83 651 6444