Can an app, school or website collect my child's data?
Data Protection Act, 2019 · sources read 4 Oct 2026
Only with your consent as parent or guardian, and only in a way that protects and advances your child's rights and best interests. Apps, schools and websites must also have proper age-checking and consent systems before handling children's data.
- How long
- The Data Commissioner must investigate and finish a complaint within 90 days.
- Where
- First the app, school or website; then the Office of the Data Protection Commissioner (online at cie.odpc.go.ke)
Steps
- As the parent or guardian, ask the organisation to correct your child's data or delete data it has no right to keep or got unlawfully.
- If they refuse or used the data without your consent, complain to the Data Commissioner, by speaking to them or in writing.
- Making the complaint is free.
Watch out
- A service that only provides counselling or child protection to a child may not need a parent's consent.
- How strict the age and consent checks must be depends on things like the technology available, how much data is handled, how much of it is likely children's, and the risk of harm.
Who this covers
- Every child whose personal data an app, school, website or other organisation collects or uses.
- A parent or guardian can use the child's data rights on the child's behalf.
- A child here means anyone under 18.
Official sources (3)
- Data Protection Act, 2019 (No. 24 of 2019) new.kenyalaw.org · read 4 Oct 2026
- Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 (L.N. 264 of 2021) odpc.go.ke · read 3 Oct 2026
- The Children Act, 2022 (No. 29 of 2022), Kenya Gazette Supplement No. 119 childrenservices.go.ke · read 4 Oct 2026