Sahel EDU

Protecting student data: Cameroon’s law 2024/017 applied to a school

A school holds sensitive data about children: identity, photo, health, family situation, results. Cameroon’s law no. 2024/017 of 23 December 2024 on the protection of personal data has applied since 23 June 2026. This guide describes its principles as published analyses report them, and what they change in practice for a school. It does not replace the advice of a lawyer, which we recommend.

What the law provides, in principle

We have not read the full text: the principles below come from analyses published in the specialist press, and their details (deadlines, thresholds, penalties) should be checked. The law applies to the processing of data of people who live in Cameroon or are there.

It creates a data protection authority, in charge of supervision, formalities and penalties, whose setting up has been announced.

Explicit, free and informed consent, with no pre-ticked box.
Data limited to what is necessary for the stated purpose.
Suitable security: encryption, restricted access, audits.
A record of processing and a procedure in case of a data breach.
Rights for the person: access, correction, erasure, objection.
A framework for transferring data outside Cameroon.

Children and sensitive data

According to these analyses, minors enjoy stronger protection: their parents or legal representative consent for them, and disclosing minors’ data without consent or security is penalised. The age at which a young person can consent alone is not stated in the sources we found.

Sensitive data (health, religion, biometric data) call for stronger safeguards. In a school, the health record, membership of a faith-based school and the photo deserve particular attention.

Health: medical record, allergies, disabilities.
Religion: faith-based school, separate classes, Friday prayer.
Image: the student’s photo, photos of outings and ceremonies.
Family: the parent’s identity document, contacts, people authorised to collect the child.

Who is responsible: the school and its supplier

The school decides why and how data are used: it is the data controller. The supplier of a software, which processes them on its behalf, acts as a processor. This split should appear in a contract saying who does what, where the data are and how they are returned at the end of the relationship.

The record of processing is the basic document: it lists the data collected, the reason, the retention period, the people who access them and the tools used.

Name a person in the school in charge of the subject.
Keep the record of processing up to date.
Read the supplier’s contract: location, sub-processors, return of data.
Set out in writing what to do in case of a leak or loss.

Consent and families’ rights

Collecting the data needed for schooling (identity, class, marks) does not call for special consent. What is optional, however, must be asked for: the photo on the school’s website, the publication of distinctions, the use of images at a ceremony.

A family should be able to ask what the school holds about its child, have an error corrected and withdraw a consent given. The request should receive a written reply within a reasonable time.

A separate consent form for each optional use.
The possibility of withdrawing consent at any time.
A record of consents given and withdrawn.
A simple procedure for asking for access or correction.
A retention period set for each category of data.

Good everyday practice

Most leaks in a school come from simple actions: a list sent to the wrong group, a shared password, a lost USB stick. The most effective rules are also the most modest.

Access limited to each person’s role: the teacher sees only their classes.
A personal account for each user, never a shared password.
No child’s data in a chat group.
Regular backups and a protected place to store them.
A departing staff member’s access closed.
Yearly awareness training for the team.

With Sahel EDU: what the software does, and what it does not claim

Sahel EDU applies several protection measures: strict separation between schools, compulsory two-step sign-in for the head of school, the deputy head and the bursar, an eight-hour session, identity documents, scans and health records encrypted with logged access, private photos, results invisible to the student and the family before publication, and encrypted backups every hour. Parents’ consents can be given, withdrawn and viewed in a register, and the people authorised to collect the child are recorded.

The data belong to the school. They are neither sold nor shared, and the school can export them in a complete archive.

Sahel EDU makes no claim of conformity with law 2024/017: that assessment belongs to a lawyer. Where data is hosted, and whether it leaves the country, is precisely a question to put to legal advice before entrusting student data to any tool.

Data separated by school.
Compulsory two-step sign-in for senior staff.
Identity documents, scans and health records encrypted, with logged access.
Consents given, withdrawn and viewable in a register.
Encrypted backups every hour; data exportable by the school.

Sources

Frequently asked questions

Does this law apply to private schools?

According to published analyses, it covers any processing of data of people in Cameroon, which includes schools. Have the detail confirmed by a lawyer.

Is parental consent needed to put a student’s photo on the school website?

Yes, it is the prudent practice: a photo is a minor’s personal data and publishing it is optional. Ask for written consent, which the parent can withdraw.

Does Sahel EDU meet the requirements of law 2024/017?

We make no claim of compliance. The software offers the protection measures described on this page, but the legal assessment, notably on the place of hosting, belongs to a lawyer.

Where are Sahel EDU’s data hosted?

We state it in writing on request, together with our protection measures, so that your lawyer can assess the question of transferring data outside the country before any commitment.

Can I try Sahel EDU before deciding?

Yes. The free trial lasts 30 days, with no commitment. The price is then negotiated with each school and can be read on the Pricing page.

Try Sahel EDU for free

Try Sahel EDU free for 30 days, no commitment. Afterwards, the price is negotiated with your school and confirmed in writing.

Book a private demonstration See pricing How the trial works