LWAYS
When Tracking Begins, So Do Your Data Obligations
When a Kenyan school deploys a bus tracking system, it begins collecting data. Location data about where the bus travels. Attendance data about which students boarded and alighted at which stops. Behavioural data about how the driver operated the vehicle on each route. And through the parent-facing application, it creates a digital relationship with every family whose child uses the service. One that involves notifications, alerts, and in some cases biometric verification of student identity.
That data has real value. It makes the school's transport operation safer, more accountable, and more efficient. It gives parents the visibility they need to trust that the institution is fulfilling its duty of care. And it gives administrators the evidence base they need to manage drivers, respond to incidents, and defend the school's liability position in the event of a complaint or claim.
It also creates obligations.
In Kenya, the Data Protection Act 2019 established a legal framework that governs how personal data is collected, stored, processed, and shared. Schools that deploy tracking technology involving students are operating within that framework whether they have formally considered it or not. The data they collect about student movements, attendance, and identity is personal data under the Act. Parents who receive notifications through a school transport app have rights under the Act that the school is responsible for honouring. And the obligations that come with operating as a data controller do not disappear because the data in question relates to transport rather than academic performance.
Most school administrators in Kenya are aware that data protection is a legal requirement. Fewer have worked through what it means specifically for school bus tracking systems and the student data those systems generate. This post addresses that gap directly.
What Data Does a School Bus Tracking System Actually Collect?
Understanding the data protection obligations that apply to school bus tracking starts with understanding what data is actually collected and by whom.
A system like the Venus School Bus Hub collects several categories of data simultaneously:
- Location data: Every vehicle in the school's transport fleet is tracked in real-time, including the route each vehicle takes, the stops it makes, and the time at which it passes each point on the route. That data is vehicle data in its raw form, but it becomes student data the moment it is combined with information about which students are on which bus.
- Attendance data: Recorded through the driver's application, this logs when each student boards and alights. It is directly linked to individual student identities and constitutes personal data under the Kenya Data Protection Act.
- Notification data: The parent application collects phone numbers and device identifiers of parents and guardians registered to receive alerts. This is also personal data and subject to the same protections.
- Biometric data: In schools that have integrated biometric attendance verification, the system may collect biometric data. This is classified as sensitive personal data under the Act and attracts a higher standard of protection and a stricter consent requirement.
What the Kenya Data Protection Act Requires of Schools
The Data Protection Act 2019 places several obligations on organisations that collect and process personal data. For schools deploying bus tracking systems, the most relevant obligations cover lawful basis for processing, consent, data minimisation, security, and data subject rights.
Lawful Basis for Processing
A school must have a legitimate legal reason for collecting each category of data its tracking system generates. For location data about school vehicles, the lawful basis is straightforward: the school has a legitimate interest in knowing where its vehicles are for safety and operational reasons. For student attendance data linked to individual identities, the lawful basis is typically the school's contractual relationship with the student's family and its statutory duty of care. For biometric data, explicit consent from the parent or guardian is generally required.
Informed Consent
Consent in the context of school bus tracking does not mean a checkbox on a form that parents sign at the beginning of the academic year without reading. It means informed consent. Parents must understand specifically what data is being collected, how it will be used, how long it will be retained, who will have access to it, and what their rights are in relation to it. A one-paragraph notice buried in a school handbook does not satisfy that standard.
Data Minimisation
The school should only collect the data it actually needs for the purpose for which the tracking system was deployed. If the system is deployed to ensure student safety on school transport routes, the school should collect data that serves that purpose. Using the same system to generate data for unrelated purposes without additional consent is a compliance risk.
Security
Data the tracking system generates must be protected against unauthorised access. This includes data stored on the platform, data transmitted between the driver application and the parent application, and data retained in the school's records. Schools using cloud-based tracking platforms need to understand where their data is stored, who the cloud provider is, and what security standards that provider operates to.
Data Subject Rights
Under the Act, parents and students have the right to know what data is held about them, to request correction of inaccurate data, and in some circumstances to request deletion. Schools need a process for handling those requests that does not depend on the IT knowledge of a single administrator.
How the Venus School Bus Hub Is Designed With Privacy in Mind
The Venus Platform was built with the data protection obligations of Kenyan schools as part of its design brief rather than as an afterthought. Several features of the platform reflect that orientation.
- Role-based access: The driver application shows the driver only the information they need to manage their route and record attendance. The parent application shows each parent only the data relating to their own child. The administrator dashboard provides school management with the full operational picture without exposing individual student data to staff who do not have a legitimate need to access it.
- Configurable data retention: Schools can define how long journey records, attendance logs, and alert histories are retained before deletion. This allows the school's data retention policy to be reflected in the operational behaviour of the system rather than requiring manual deletion processes.
- Privacy-respecting notifications: The notification system within the parent application communicates the information parents need, specifically bus location relative to their child's stop, without transmitting unnecessary identifying information about other students on the same route.
For schools that have concerns about specific data handling requirements, the Trackalways Africa team works through those requirements during the onboarding process and configures the platform accordingly.
Three Steps Schools Should Take Before Deploying a Bus Tracking System
Schools considering school bus tracking technology in Kenya should take these three steps before deployment to ensure they are meeting their data protection obligations.
- Review your existing data protection policy. Assess whether it covers the categories of data that a tracking system will generate. Most school data protection policies were written with academic records in mind and do not explicitly address location, attendance, or biometric data generated by transport systems.
- Prepare a parent information notice. This should explain specifically what data the tracking system collects, why it is collected, how long it is retained, who has access to it, and what parents can do if they have concerns. Distribute it before the system goes live, not after.
- Vet your platform provider on data security. Ensure the platform you select is operated by a provider that takes data security seriously. They should be able to explain clearly where data is stored, what access controls are in place, and what the process is for responding to a data breach. Choosing a platform from a provider that cannot answer those questions is itself a data protection risk.
Frequently Asked Questions
Does a school need explicit consent from every parent before deploying bus tracking?
For standard location and attendance tracking, the school's contractual relationship with the family and its duty of care typically provides a sufficient lawful basis. For biometric data collection, explicit informed consent is required under the Kenya Data Protection Act.
How long should schools retain bus tracking data?
Retention periods should be defined in the school's data protection policy. For journey records and attendance logs, a term or an academic year is a common retention period. Records relating to specific incidents may need to be retained longer depending on the nature of the incident and any associated legal proceedings.
Can parents request deletion of their child's data from the tracking system?
Under the Kenya Data Protection Act, data subjects have the right to request deletion of their personal data in certain circumstances. Schools should have a clear process for handling such requests.
What happens to the data if the school changes tracking provider?
Schools should ensure that their contract with any tracking provider includes a data portability and deletion provision. This should require the provider to return or delete all school data when the contract ends.
Is the Venus School Bus Hub compliant with the Kenya Data Protection Act?
The platform is designed to support schools in meeting their data protection obligations. Specific compliance questions relating to a school's individual circumstances should be discussed with the Trackalways Africa team during onboarding.
Get Expert Guidance for Your School
Deploying a bus tracking system is a significant step forward for any school. Getting the data privacy side right protects your institution, builds parent trust, and keeps you on the right side of the law.
To book a demonstration or discuss data privacy requirements for your school, contact Trackalways Africa on +254 116 257285 or visit trackalwaysafrica.com.