POPIA consent forms for crèches: what to include

Kindi Team • November 9, 2026

A POPIA consent form for a crèche must be signed by a parent or legal guardian (the "competent person"), explain exactly what information you collect about the child and why, ask for separate, specific consent for health details, photos and anything optional, and tell parents how to withdraw consent. It sits alongside your privacy notice and your registered Information Officer; it doesn't replace them.

Almost everything a crèche does involves children's personal information, and the Protection of Personal Information Act (POPIA) treats it with extra care. This guide covers what the Act says and gives you a checklist for your next enrolment pack. It's general information, not legal advice.

What POPIA says about children's information

POPIA defines a child as a person under 18 who can't legally make decisions about themselves without help from a "competent person", meaning someone legally able to consent on the child's behalf. In practice, at a crèche, that's the parent or legal guardian.

Section 34 sets a general rule: you may not process a child's personal information. Section 35 then lists the exceptions. The one crèches rely on most is processing "with the prior consent of a competent person". Other exceptions include processing that is necessary to meet a legal obligation.

That second point matters. The Children's Act regulations require a partial care facility to keep a register of each child's details, contacts and any chronic condition or dietary requirement. Your form shouldn't pretend those depend on a parent ticking a box. Section 18 of POPIA says you must tell parents whether supplying information is voluntary or mandatory, and what happens if they don't supply it. So split your form into "we need this to enrol and care for your child" and "this is optional, and you can say no".

Special personal information: health, religion and race

Section 26 lists "special personal information", which includes religious or philosophical beliefs, race or ethnic origin, health, and biometric information. Processing it is prohibited unless an exception in section 27 applies, such as consent, or one of the specific authorisations in sections 28 to 33.

For a crèche, that usually means:

Health: allergies, chronic conditions, medication, immunisation records, doctor's details. You need these to keep the child safe, and the partial care norms require you to keep medical records. Section 32 also requires health information to be treated as confidential.
Religion: usually surfaces as dietary needs or which celebrations a child joins. Ask only if you need it, and say why.
Race: don't collect it by habit. If a funder or government return genuinely requires it, name that requirement on the form.

Keep special information off the classroom wall and out of the parent WhatsApp group. For managing health records day to day, see medical profiles in early childhood settings.

What makes consent valid

POPIA defines consent as a "voluntary, specific and informed expression of will". Each word does work:

Voluntary: a parent must be able to say no to optional uses, like marketing photos, and still enrol their child.
Specific: one blanket "I consent to everything" signature is weak. Use separate tick boxes for separate purposes.
Informed: the parent must know what they're agreeing to, in plain language.

Under section 11(2), the burden of proof is on you: the crèche must be able to show that consent was given.

Photo and media consent

Photos and videos of children are personal information, and they're the easiest thing to get wrong. Ask for photo consent in tiers, each with its own yes/no:

Photos kept in the child's own record or sent privately to that child's parents.
Group photos where other parents in the class may see this child.
Photos on the crèche's website, social media, brochures or signage.
Photos shared with newspapers or third parties.

Record each child's choices where staff can check them before posting. More in photo sharing at daycare: privacy and consent.

The consent form checklist

Use this when you draft or review your form. Section 18 of POPIA sets out most of what parents must be told when you collect their information.

The crèche's full name and contact address (the "responsible party").
The name and contact details of your Information Officer.
The child's details and the parent's or guardian's details, including their relationship to the child and confirmation that they may consent on the child's behalf.
What information you collect, and why, in plain language.
Which information is required (and the law that requires it) and which is optional, and what happens if it isn't supplied.
A separate section for health information, with a note that it is kept confidential and shared only with staff who need it and, in an emergency, with medical services.
Tiered photo and media consent, each tier with its own tick box.
Who you share information with, by category: for example, your software provider, your accountant, or a government department for registration or subsidy purposes. Say whether any of it is stored outside South Africa.
How long you keep records and why.
The parent's rights: to access and correct information, to object, and to complain to the Information Regulator, with the Regulator's contact details.
How to withdraw consent, and who to tell.
Signature, printed name and date.

For the wider picture, see POPIA for crèches.

Keeping records of consent

Keep the signed form (paper or digital) for as long as you use the information it covers. Section 14 says records mustn't be kept longer than necessary, unless the law requires it or another exception applies. The Children's Act regulations require partial care registers and child files to be kept for at least three years after a child leaves. When a parent changes a choice, file the new form with a date rather than overwriting the old one, and securely destroy what you no longer need.

Withdrawal of consent

Section 11(2) lets a parent withdraw consent at any time. Withdrawal doesn't make earlier processing unlawful, but from that point you must stop the use they withdrew. If a parent withdraws photo consent for social media, remove the child from future posts and, as good practice, take down existing posts where you can.

If your records are on paper and in WhatsApp, consent is hard to prove and easy to break. Kindi keeps enrolment forms, medical profiles and photos in one place. Parents see only their own child's photos, and an audit trail shows who viewed sensitive records. See plans and pricing.

Registering your Information Officer

A consent form without the rest of the framework won't make you compliant. For a private body, the Information Officer is by default the head of the organisation, usually the owner or principal. Section 55(2) says Information Officers may only take up their duties once they are registered with the Information Regulator. Registration is done on the Regulator's eServices portal. Our POPIA compliance guide for daycare centres walks through the rest.

Frequently asked questions

Can one parent consent, or do we need both?

POPIA requires consent from a competent person, meaning someone legally able to consent for the child. Most crèches have one parent or guardian sign. Where there's a custody dispute or a court order, check who holds parental responsibilities and rights, and get advice.

Do we need consent to keep an attendance register?

The register itself is a legal requirement for registered partial care facilities, so it rests on legal obligation rather than consent. You must still tell parents about it and keep it secure.

Is a WhatsApp "OK" from a parent valid consent?

It can be evidence, but it's hard to keep and easy to lose. A signed form, or a digital form with a name, date and specific tick boxes, is much stronger. See WhatsApp groups vs a parent app.