Accounts and identity
Multi-factor authentication for every staff member, separate administrator accounts, and leavers closed on the day they leave. Platform detail is on Google Workspace and Microsoft 365 for Education and Microsoft 365 security.
POPIA for schools: cybersecurity and online safety
POPIA for schools means handling the personal information of learners, parents and staff lawfully and keeping it secure, knowing that much of it belongs to children. Arke Technologies helps South African schools, colleges and universities secure accounts, devices and networks, meet the Act's conditions and keep learners safe online.
What the POPIA Act means for schools
The Protection of Personal Information Act (POPIA), enforceable since 1 July 2021, applies to every school that collects, stores or shares personal information, public or independent. A school holds more of it than most organisations its size: learner names, ID numbers, addresses, marks, disciplinary and counselling records, medical and allergy notes, photographs, parents' contact and banking details for fees, and staff HR and payroll records.
Two features of the POPIA Act for schools set them apart. First, most learners are children, and POPIA prohibits processing a child's personal information unless an exception applies, such as the consent of a parent or guardian or a legal obligation (POPIA, sections 34 and 35). Second, schools routinely hold special personal information, such as health details and religious affiliation, and sometimes biometric data from fingerprint attendance or access systems; each needs its own lawful basis (POPIA, section 26 onwards).
The Act sets eight conditions for lawful processing, from accountability and purpose to security safeguards and the rights of the people the data describes. Every school needs an information officer registered with the Information Regulator. The role sits with the head of the institution by default, so confirm who that is for your school's legal structure; deputies can share the work. Administrative fines run to R10 million (POPIA, section 109). This page is part of our education IT services.
Where school data leaks
The usual causes of a school data incident are ordinary habits, not sophisticated attacks:
Phishing of staff email. A compromised bursar's or principal's mailbox is used to send parents new banking details for fees.- Shared and inherited passwords. One administrator password known to three former staff members.
- Accounts that outlive people. Learners and staff who left years ago can still sign in.
- Over-shared files. Mark sheets, medical lists and class photographs shared with anyone who has the link.
- Unencrypted laptops and USB sticks. Lost with a term's reports on them.
- An old server in a cupboard. Unpatched, holding the administration database, with no tested backup: ransomware's easiest target.
- Free apps signed up by teachers. Learner data held by a provider the school has no agreement with, often outside South Africa.
What we put in place
Email security
Phishing and impersonation filtering, domain authentication (SPF, DKIM and DMARC) so nobody else can send as the school, and warnings on external mail. See email security.
Devices
Encryption, screen locks, patching and remote wipe for staff laptops, and managed policies for learner devices.
Network
Separate networks for learners, staff and administration, and content filtering at the firewall. See school networks and Wi-Fi.
Backups
Backups of Google Workspace, Microsoft 365 and the database behind your school management software, with tested restores, so ransomware or an accidental deletion is recoverable.
Testing
Security assessments and penetration tests, which we scope, perform and retest, and we help fix what they find. See cybersecurity assessment and penetration testing.
People
Short, practical security awareness training for staff, focused on phishing and payment fraud.
Incident response
A written plan for who decides, who notifies the Information Regulator and parents, and how evidence is kept. See incident response.
Computer monitoring software for schools, and what POPIA asks of it
Computer monitoring software for schools comes in three kinds. Screen monitoring software for schools, usually called classroom management software, lets a teacher see learner screens, push a link to every device and lock screens during a test. Student monitoring software, sometimes called safeguarding software, watches searches and activity for signs of bullying, self-harm or harmful content and alerts a designated staff member. Filtering and logging at the firewall records which sites each device reached.
Each of these processes children's personal information, so POPIA shapes how it is used:
| Principle | What it means for monitoring |
|---|---|
| A stated purpose | Teaching, learner safety and security, written into the acceptable-use policy that parents and learners sign |
| Proportion | School devices and school accounts, for school purposes; monitoring a learner's own phone goes much further and needs a stronger reason |
| Limited access | Alerts go to named, trained staff, not every teacher, and every view of the data is logged |
| Limited retention | Screenshots and alerts deleted to a schedule, not kept indefinitely |
| Operator agreement | A written agreement with the software vendor, and knowledge of where it stores data |
We assess what the school needs, configure the controls built into the Google Admin console, Chrome management and Intune, and deploy and support dedicated monitoring tools where they are justified.
Online safety for learners
- Content filtering by grade and group, with safe search enforced and video platforms restricted to suitable content.
- Younger learners limited to email and file sharing within the school's own domain.
- Third-party apps allowed only once approved, so learner data goes only where the school has agreed.
- Clear reporting routes for learners and staff, and the logs the school needs to investigate bullying or misuse.
- A termly review of filtering and settings with the staff member responsible for learner well-being.
Governance, procurement and continuity
- SLA and escalation. Exclusions and escalation paths are in writing, and incidents are prioritised from P1 (a critical outage) to P4 (a low-impact request), with response and resolution targets matched to the impact of downtime and agreed in your SLA. Monitoring is automated and continuous; human response follows the SLA, with out-of-hours cover available by agreement.
- Board reporting. King IV Principle 12 asks the governing body to govern technology and information, and the monthly report gives school governing bodies and college councils a record of risks, incidents and actions.
- Standards. Our controls are aligned with ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Controls. Arke Technologies is not itself ISO 27001 certified.
- Procurement. Arke Technologies is a Level 1 B-BBEE contributor, giving 135% procurement recognition (sworn affidavit available on request). Company documents, our CSD number and tax compliance status are available on request, and we complete SBD forms when a bid requires them. We work from a written proposal and your purchase order, or respond to your request for quotation or tender; where a provincial or national department is the buyer, we work to PFMA procurement and reporting disciplines. See PFMA and MFMA ICT procurement.
- Continuity. Your data, credentials, policies and documentation stay yours. A certified team works remote-first from Johannesburg and on site as your SLA sets out: one contract, one accountable team, and a clean handover if you leave.