The prohibition — and the section 35 gateways
Children get the same inverted structure as special personal information: section 34 prohibits processing a child’s personal information, subject to section 35(1)’s gateways:
...prior consent of a competent person; processing “necessary for the establishment, exercise or defence of a right or obligation in law”; compliance with an obligation of international public law; historical, statistical or research purposes; or information “deliberately been made public by the child with the consent of a competent person”.
The structure matters for the same reason it matters everywhere in POPIA: consent is a gateway, not the gateway. A school does not run on parental consent forms — it runs on the statutory framework of schooling. The consent forms belong where the gateways run out.
Who is a competent person?
A “child” is a person under 18 who is not legally competent to act without assistance, and a “competent person” is anyone legally competent to consent on the child’s behalf — typically a parent or guardian (s 1). Practical consequences: the 16-year-old’s own signature does not open the consent gateway; divorced parents’ consent disputes are family-law questions the school should not adjudicate by email; and platforms aimed at minors need consent architecture built around the parent, not the user.
Schools: what needs consent — and what never did
| Scenario | Position | Why |
|---|---|---|
| Enrolment records, attendance registers, academic reports | Lawful without parental consent | Schools act under legal obligations and the establishment/exercise of rights — the statutory schooling framework is the gateway. |
| Emergency contact and medical-needs information | Lawful | Protecting the child’s vital interests and exercising the school’s duty of care. |
| Class photo in the school prospectus or on social media | Needs a competent person’s consent | Marketing/publication serves no legal right or obligation — this is the genuine consent territory. |
| Selling or giving the learner database to a tutoring company | Not lawful | No gateway covers it; commercial exploitation of children’s data is what section 34 exists to stop. |
The pattern generalises beyond schools: administration within the legal framework the child is enrolled in runs on the gateways; publication, promotion and commercial exploitation of children’s information is where the competent person’s consent is genuinely required — and where the Regulator’s sympathy, in any complaint, will sit entirely with the child.