In this guide · 8 sections
- 01Why preschools are a high-risk PDPA environment
- 02Consent for children's photos and videos
- 03WhatsApp groups vs a parent communication app
- 04What a PDPC decision about a preschool teaches
- 05Staff phones, devices and photo rules
- 06Retention: daily logs, incident reports and CCTV
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Get written parental consent for photos, separate from enrolment. Share updates through a parent app with individual parent accounts rather than class WhatsApp groups, keep photos off staff phones, set retention periods, and give teachers written rules, not just training.
Why preschools are a high-risk PDPA environment
A preschool holds personal data about children, parents, authorised pick-up persons and staff, and teachers handle it all day: photos, health notes, allergies, incident reports, attendance and fees. Children's data is sensitive by nature, and parents notice quickly when it goes somewhere it should not.
The PDPC's Advisory Guidelines on the PDPA for Selected Topics state that where a minor is below 13 years of age, the organisation must obtain consent from the parent or guardian, and should tell them the purposes for which the child's data will be collected, used and disclosed. For a preschool, that covers every child.
This guide is general information, not legal advice. ECDA's licensing requirements apply alongside the PDPA.
Consent for children's photos and videos
Separate the different uses of photos, because parents may agree to some and not others.
| Use | Consent approach |
|---|---|
| Private daily updates to the child's own parents | Explained at enrolment as part of the service; parents can opt out of photos |
| Group photos shared with all parents in the class | Separate consent, because other families see the child |
| Website, social media, brochures and ads | Separate, optional marketing consent, recorded per child |
| Photos shared with external parties (photographers, event partners) | Specific consent naming the purpose |
The same PDPC guidelines say that if consent to publish a photo is withdrawn, the organisation must stop future publication. Keep a consent register that teachers can check before posting, and update it the day a parent changes their mind. Our guide to preschool websites and ECDA rules covers photos used for marketing.
WhatsApp groups vs a parent communication app
Class WhatsApp groups are free and every parent already has the app, which is why many centres use them. The problem is structural: in a group, every message, photo and phone number is visible to every family.
Class WhatsApp group
- Free and familiar
- All parents see every phone number
- Group photos and files reach every family
- Messages sit on teachers' personal phones
- No central record or control when staff leave
Best for: General announcements only, if at all.
Parent communication app
Recommended- Each parent sees only their own child's updates
- Centre-owned accounts and devices
- Staff access removed centrally when they leave
- Subscription fee; vendor holds the data
Best for: Daily photos, logs, incident reports and fee notices.
Our comparison of WhatsApp vs Slack vs Teams for team chat covers the staff side. For parents, if you keep a WhatsApp channel, use it one-way for announcements and never for photos or individual matters.
What a PDPC decision about a preschool teaches
In the PAP Community Foundation decision (2019 SGPDPC 6), a teacher sent a photo of a school trip attendance list to a parents' WhatsApp group. It contained details of 15 children and their parents, including the NRIC numbers of five parents. The teacher deleted it quickly after a parent pointed it out, but the parent complained to the PDPC.
The PDPC found a breach of the Protection Obligation, mainly because the operator had no specific policies guiding staff on handling personal data when communicating with parents, including through messaging apps. It had provided PDPA training, but the decision said training alone cannot replace policies and procedures. The operator received a warning after suspending its WhatsApp groups, introducing chat group rules and rolling out retention and information security policies.
- Teachers need written rules for what may be sent to parents, where and how.
- Lists and forms with several families' data never go into group chats.
- Collecting NRIC numbers for a trip is itself questionable; collect only what is needed.
- Training explains the rules; it does not replace them.
Staff phones, devices and photo rules
If teachers take photos on their own phones, children's images end up in personal galleries, cloud backups and chat histories that the centre cannot control or delete.
Staff device and photo rules
If staff must use personal phones for any work app, a basic mobile device management setup lets you separate and remove work data; see our BYOD and MDM guide.
Retention: daily logs, incident reports and CCTV
The PDPA requires you to stop keeping personal data once it is no longer needed for the purpose collected or for legal or business reasons. Preschools generate a lot of it, so set a period for each type.
| Record | Typical approach |
|---|---|
| Daily photos and activity updates in the parent app | Parents download what they want; centre deletes after the child leaves, on a schedule |
| Meal, nap and toilet logs | Short period, unless linked to an incident |
| Incident and injury reports | Kept longer; check ECDA requirements and your insurer's advice |
| CCTV footage | ECDA says centres need not keep more than 30 days of footage |
| Enrolment, fee and subsidy records | Follow tax and ECDA record requirements |
ECDA's CCTV FAQ for parents confirms CCTV has been mandatory in all preschools since 1 July 2024, that footage shown to parents must be masked in line with the PDPA, and that centres may charge for masking. Our CCTV and PDPA guide covers notices and access requests.
Do it yourself or get help?
A centre can do much of this itself: a consent form with separate choices, a consent register, written WhatsApp and photo rules, centre-owned devices and a retention schedule. Our PDPA checklist for small businesses gives the wider framework.
Our PDPA Compliance Pack (S$690) prepares consent forms, policies and staff rules for a preschool. Microsoft 365 / Google Security Lockdown (S$590) secures staff accounts and devices, and Security Awareness Training (S$390) walks teachers through the rules with real examples.
Frequently asked questions
Yes. PDPC guidance says that for children under 13, consent must come from a parent or guardian. Explain at enrolment how daily photos are shared, and get separate consent for group photos seen by other families and for marketing use. Keep a record and honour withdrawals promptly by stopping future use.
WhatsApp is not banned, but class groups expose every family's phone number and every shared photo to all members, and messages sit on teachers' personal phones. PDPC warned a preschool operator in 2019 after a teacher shared a list with parents' NRIC numbers in a parents' group. Use groups for announcements only, under written rules.
It is best avoided. Photos on personal phones end up in personal cloud backups and galleries the centre cannot control or delete. Use centre-owned devices with the parent app, switch off personal backups, and if personal phones are ever used, require deletion right after upload under a written rule.
ECDA states that preschools are not required to retain more than 30 days of CCTV footage. Keep footage linked to an incident or complaint longer, until the matter is resolved. When parents view footage, it must be masked to protect other children and adults, and centres may charge a fee for masking.
Check that each parent sees only their own child's data, staff have individual logins with MFA, accounts can be removed centrally, data can be exported and deleted when a child leaves, and the vendor explains where data is stored and how it is protected. Put data protection terms in your contract with the vendor.