Zande › Free templates › POPIA consent for a child
POPIA Consent Form for a Child
Every crèche holds a child's name, ID number, home address and medical notes. POPIA needs the parent or guardian to agree before you hold it. The Act does not say the agreement must be written down. Write it down anyway, because a signed page is the only version you can produce two years later. This is the form, with photo consent kept separate so a parent can say no.
No email needed, no catch. Print it in black and white at any copy shop. It fits one side of A4.
What it is
This is a written consent form. A parent or legal guardian signs it to allow the crèche to hold and use a child's personal information. It also records, on a separate signature, whether they agree to photographs and video.
It is your centre's own record. It is not a government form and no official issues it to you. Its job is to prove, on paper, that you had permission before you wrote a child's ID number into a register or put a face on Facebook.
Who asks for it
Two different offices care about this, for two different reasons. Knowing which is which saves you a lot of worry.
The Information Regulator (South Africa) enforces the Protection of Personal Information Act 4 of 2013. Under section 34 the processing of a child's personal information is prohibited. Section 35 opens the door again, and the main route through it is prior consent from a competent person, meaning the parent or legal guardian. Every learner in a crèche is a child under the Act. So every learner file needs a signed consent sitting behind it.
Your provincial education department, through the district ECD official, is the one you will actually see in your yard. ECD moved from the Department of Social Development to the Department of Basic Education on 1 April 2022. Registration and subsidy now run through the province and its district office, not the social development office. The district official is not enforcing POPIA. She will probably not ask for a POPIA form by name. She checks that the learner file is complete and signed by a parent. A signed consent filed with the enrolment form makes that file complete and settles the question of whether the parent knew their child's details were going onto a subsidy claim, because that claim leaves your building and goes to a government office.
You are the responsible party under POPIA. The person who heads the centre is the Information Officer by default, and Information Officers are required to register with the Information Regulator. Check the current registration steps on the Information Regulator's own website before you pay anyone to do it for you. Nobody needs to be paid to do it for you. Put that person's name and cell number on the form so a parent knows exactly who to phone.
Then keep the signed forms in a locked cupboard or a locked office. Section 19 of POPIA requires reasonable safeguards on the information you hold, and a file of consent forms on an open shelf is itself the security problem the Act is about. Each form carries a child's ID number and a home address, which makes it the highest-risk paper in the building.
What must appear on it
- Full name of the crèche, physical address and phone number, named clearly as the responsible party holding the information.
- Name, position, phone number and email of the Information Officer, so the parent has one named person to contact.
- Child's full name, date of birth, class or group, and date of enrolment.
- Full name of the parent or guardian signing, their cell number, their relationship to the child, and their ID number with the reason for it written on the form. Say it is needed for the subsidy means test and to confirm who is signing. If your centre claims no subsidy, drop the ID number and keep only the name and cell number.
- A plain list of exactly what the centre holds. Name, date of birth, ID or birth certificate number, home address, home language, medical conditions, allergies, chronic medication, immunisation record, emergency contacts, attendance record, fee account and payment history, photographs.
- The reason for each group of information, written next to it in ordinary words. Never write 'for administration purposes'.
- Who the information is shared with, each one named. The district ECD official at the provincial education department for registration and subsidy claims. A clinic or hospital in a medical emergency. The centre's bookkeeper or auditor. Nobody else.
- A line stating the centre does not sell parent or learner information and does not pass it to any other business.
- How long the centre keeps the file after the child leaves, written as an actual number of years, not 'as required'. Then a second, longer period for fee and payment records, because company and tax law require accounting records to be kept longer than the rest of the file. Ask your bookkeeper for the exact period that applies to your centre and write that number in.
- The parent's right to ask what you hold, to have it corrected, and to withdraw consent in writing at any time, with a note that withdrawal does not undo processing that was lawful before the withdrawal.
- A line confirming the signer is the parent or legal guardian and is legally entitled to give this consent for the child, with a note telling you to get both signatures where both parents share parental responsibility.
- A separate section for photographs and video, with its own signature line, physically apart from the main consent.
- Inside the photo section, a separate yes or no tick for each use. Displayed inside the centre. Sent in a closed class WhatsApp group. Posted on the centre's Facebook page or website. Printed in flyers, posters or a brochure. Included in a report to the district office or a funder.
- A separate tick for whether the child's first name may appear next to the photo.
- A sentence in the photo section, in plain words, saying the child will not be excluded from any activity if the parent ticks no.
- Wet-ink signature of the parent or guardian, printed name, and date, on both sections.
- Wet-ink signature of the staff member who took the form, printed name, and date.
- A blank line for the date consent was withdrawn, left empty at signing and filled in only if it happens.
A filled-in example
PARENT CONSENT: CHILD'S PERSONAL INFORMATION AND PHOTOGRAPHS
Little Blessings Educare Centre, 27 Mkhize Street, Kabokweni, Mpumalanga. Phone 013 000 0000.
Information Officer: Nomsa Mahlangu, Principal. 082 000 0000. nomsa@littleblessings.co.za
| Child Karabo Sibiya | Date of birth 14 March 2024 |
| Class Toddler Group B | Enrolled 20 January 2026 |
| Parent or guardian Thandiwe Sibiya (mother) | ID number 8903 12 **** 08 5 (masked in this example only, write the full number on your form) |
Phone numbers in this example are not real. We ask for the parent's ID number for the subsidy means test and to confirm who is signing.
SECTION A: INFORMATION WE HOLD AND WHY
| What we hold | Why we hold it |
|---|---|
| Name, date of birth, birth certificate number | Enrolment, age group placement, subsidy claim |
| Home address, home language, emergency contacts | Daily care, safe collection, reaching you quickly |
| Asthma, no known allergies, clinic card copy | Keeping Karabo safe and treating an emergency |
| Daily attendance record | Register and the subsidy claim, paid per day attended |
| Fee account and payment history | Billing and the centre's financial records |
Shared with: the district ECD official at the Mpumalanga Department of Education for registration and subsidy claims, our local clinic in a medical emergency, and our bookkeeper. We do not sell this information and we do not give it to any other business.
Kept for: 5 years after Karabo leaves the centre, then destroyed. No single law sets a retention period for learner records, so this centre chose 5 years and wrote the number down.
Fee and payment records are kept longer because company and tax law require it. Ask your bookkeeper for the exact period that applies to your centre and write that number here.
Your rights: ask what we hold, have it corrected, or withdraw this consent in writing at any time. Withdrawal does not undo what was lawful before.
I am the parent or legal guardian of Karabo and I am legally entitled to give this consent for her. Where both parents share parental responsibility, both should sign.
Signed: T. Sibiya Name: Thandiwe Sibiya Date: 22 January 2026
SECTION B: PHOTOGRAPHS AND VIDEO (SEPARATE CONSENT)
You may tick NO on any line. Karabo takes part in every activity either way. Nothing changes for your child.
| The centre may use photographs or video of my child in this way | YES | NO |
|---|---|---|
| Displayed inside the centre and in her own portfolio | X | |
| Sent in the closed Toddler Group B parent WhatsApp group | X | |
| Posted on our Facebook page or website | X | |
| Printed in flyers, posters or our brochure | X | |
| Included in a report to the district office or a funder | X | |
| My child's first name may appear next to the photo | X |
Signed: T. Sibiya Name: Thandiwe Sibiya Date: 22 January 2026
Received by: B. Nkosi, Bongi Nkosi, Administrator, 22 January 2026. Consent withdrawn on: ______________
Read what Thandiwe actually did. She said yes to photos inside the centre and in the class group. She said no to Facebook and no to her daughter's name appearing. Karabo is still photographed at every party and still goes on every outing. That is what separate consent looks like when it works.
Names, dates and amounts are invented. Use your own centre's details.
What happens at inspection if you do not have it
What the district official does. On a monitoring or registration visit she asks for a sample of learner files and reads them in front of you. She is looking for the enrolment form, a copy of the birth certificate or clinic card, the immunisation record, emergency contacts and a parent signature. If there is no signed consent she tells you verbally and writes it on her monitoring note, and you get a date to fix it. Nobody closes a crèche over a missing consent form. But if your registration application is still open, an incomplete file is one of the easiest reasons for it to sit on a desk for another two months. And a subsidy claim at R24 per child per day attended, paid only on your approved subsidised places, not on every learner enrolled, submitted on children whose parents signed nothing, is a claim you cannot defend if a parent later says she never agreed to her child's details going to a government office.
What the Information Regulator does. This one does not start with an inspection. It starts with a parent. The usual trigger is a photo of a child still on your Facebook page after the parents separated, or a class list with 40 cell numbers forwarded to someone outside the centre. The parent complains to the Information Regulator. The Regulator writes to you. The letter asks what happened, what information was involved, and what consent you relied on, and it gives you a deadline to answer. A signed, dated form that covers that exact use is the answer the letter is asking for. Without it you have nothing to send back. The Regulator can then issue an enforcement notice telling you what to change and by when. Failing to comply with that notice is where it turns serious. The Act does allow an administrative fine of up to R10 million at the top end, and that end is built for large-scale abuse, not a crèche with one Facebook post. For a 60-child centre the realistic outcome is a letter, a deadline, and a written undertaking.
What actually costs you money. Not the Regulator. The parent. In a small town, one story about a child's photo posted without permission moves through the school gate faster than any notice, and the mother who told that story pays fees. The form is cheaper than the story.
If information leaks. Section 22 of POPIA requires you to notify the Information Regulator and the affected parents as soon as reasonably possible after you find out. There is no fixed hour deadline written into the Act. If a consultant tells you about a 72-hour rule, he is quoting European law and you should be careful what else he tells you. Your signed consent forms are also your contact list for that notification, which is the second reason to keep them filed properly.
Common questions
Can a parent refuse photographs and still keep the child at the crèche?
Yes, and you must write that on the form. Photo consent is a separate decision from consent to hold the child's information, so it gets its own signature. If a parent ticks no, keep the child out of the frame or take the photo and do not post it. Leaving a child out of an outing because her mother refused Facebook photos is the fastest way to turn a small matter into a complaint.
Who is the Information Officer at a small crèche?
The person who heads the centre. If you own and run it, that is you. You do not appoint an outside expert and you do not pay a consultant for the title. Information Officers are required to register with the Information Regulator. Check the current registration steps on the Regulator's own website, because that channel has changed more than once. Write your name and cell number on the form so a parent has one person to phone.
Do I need a new signed form every year?
No. Consent stays valid until the parent withdraws it or the purpose changes. Check it once a year at re-enrolment. Get a fresh signature when something new starts, for example the first time you open a class WhatsApp group or start a Facebook page. A form signed in 2023 for photos inside the centre does not cover a page you opened in 2026.
A parent withdrew consent after I already sent the subsidy claim. Must I delete everything?
No. Withdrawal stops future processing. It does not undo processing that was lawful when you did it. Records you are required by law to keep, such as financial records and the daily attendance register behind a subsidy claim, you keep for the period the law sets. Stop using the child's photograph the same day, take it down where you can, and write the withdrawal date on the form.
Our class list with parent cell numbers was forwarded to someone outside the centre. What now?
That is a security compromise under section 22 of POPIA. You must notify the Information Regulator and the affected parents as soon as reasonably possible after you find out. There is no fixed hour deadline in the Act. Anyone selling you a 72-hour rule is quoting European law. Tell the parents as soon as you know, in writing, and say what was shared, what could happen to them because of it, what you are doing about it, and who they can phone. That written notice is what section 22 asks for.
Zande keeps consent status on each learner's record, with the photo permission held as its own flag, so you can check who signed and who said no before a picture goes into a class group.
Set up your centre free →Or WhatsApp us and we will set it up with you, free.