KidswithoutABox

Call Directions Website Contact the school

KidswithoutABox An educational technology company building writing abilities in K-12 learners.

23/09/2026

Some of the best compliance conversations I’ve had started with a question that sounded almost too basic.

“Why do we have this data?” Not, “Is this covered by the privacy policy?” Or

“Did the vendor say they were compliant?”

That question can expose a surprising amount.

The purpose of the processing.

The lawful basis.

The people with access.

The vendors involved.

The retention period.

The security controls and what happens when something goes wrong.

We are seeing this play out in real cases.

In Nigeria, the Nigeria Data Protection Commission (NDPC) opened a forensic investigation following allegations concerning the use of students’ personal data involving University of Lagos, LOTUS Bank and Hackerbella.

In the US, U.S. Department of Health and Human Services (HHS) OCR continues to pursue enforcement around whether organizations have properly assessed risks to sensitive health information.

In Europe, the Data Protection Commission Ireland has imposed a €403 million fine on Google relating to location-data processing.

That is why I’m less interested in asking organizations whether they are “compliant”. Instead, I want to know what they can actually demonstrate.

So here’s my question for you:

What is the data protection question you’ve been too embarrassed to ask?

Put it in the comments.

No jargon. No judgement.

Follow KidswithoutABox for more data protection compliance tips.

21/09/2026

It has become increasingly necessary to know what happens after an organization collects personal data.

19/09/2026

Why “it’s only for attendance” is not enough when the data belongs to a child

Your privacy policy might be telling a story your website doesn't follow.I've seen this more times than I should.The pri...
20/08/2026

Your privacy policy might be telling a story your website doesn't follow.

I've seen this more times than I should.

The privacy policy says the business collects a name, email and phone number.

Then I look at the website.

There's Google Analytics.

A payment gateway.

A newsletter platform.

Cookies.

A CRM.

Third-party plugins.

Sometimes even advertising or tracking tools.

And none of them appear properly in the privacy notice.

That's where the problem starts.

Under the NDPA, transparency isn't optional. Personal data must be processed fairly, lawfully and transparently, and the information provided to people must be clear and accessible.

The recent Emmanuel Harunna v. NDPC case is another reminder that Nigerian data protection regulation isn't theoretical anymore. The Federal High Court upheld the NDPC's authority to require registration of Data Controllers and Processors of Major Importance.

And there's another case worth watching.

The NDPC is investigating allegations involving UNILAG, Lotus Bank and Hackerbella concerning the use of students' personal data to open bank accounts without a lawful basis.

The Commission said it would look at things including privacy notices, lawful bases, data sharing, data minimisation, retention and DPIAs.

So I would ask every business owner to do one simple thing this week:

Open your own website.

Read your privacy policy.

Then check what your website is actually collecting and sending to third parties.

If the two stories don't match, don't ignore it.

Fix the gap.

Your privacy policy should describe your data practices — not your intentions.

DM me “CHECKLIST” if you want a practical website privacy review checklist.

I have realised that one of the easiest privacy mistakes to make is this:I collect the data → I send it to an app → I fo...
11/08/2026

I have realised that one of the easiest privacy mistakes to make is this:

I collect the data → I send it to an app → I forget about it.
But the data doesn't forget. 😂

Your CRM, payment processor, cloud provider, email platform, analytics tools and other vendors may all form part of your data-processing ecosystem.

And recent Nigerian developments show why that ecosystem deserves attention.

The Zenith Bank Plc matter involves allegations concerning unauthorised access and disclosure of confidential financial records. It is still a court matter, so I am not treating the allegations as facts.
The Nigeria Data Protection Commission (NDPC) has also investigated other data-processing concerns, including the Remita / Sterling Bank matter and its investigation into Temu

My takeaway?
Don't just ask:
“Do I have a Privacy Policy?”

Ask:
“Where is my customer's data going?”
That's where privacy compliance gets real.

📩 Quick question for School owners:What tool do you use to collect your customers' emails?Google Forms?Website / CRM?I’m...
10/08/2026

📩 Quick question for School owners:
What tool do you use to collect your customers' emails?
Google Forms?
Website / CRM?
I’m asking because an email address is still personal data.
And collecting it is only one part of your responsibility.
I also need to know:
Where is it stored?
Who has access?
Why am I keeping it?
Recent events have made this even more relevant.
In April 2026, the Nigeria Data Protection Commission announced an investigation into an alleged data breach involving Remita, Sterling and other entities.
The Commission said it was examining the data involved, the risks to data subjects and the measures taken to mitigate the incident.
So I want to hear from you:
What tool do YOU use to collect customer emails?
👇 Drop the name below.
I’ll pick a few common ones and explain the privacy issues businesses should check

Many organisations spend hours comparing software prices but almost no time checking what those tools do with customer d...
08/08/2026

Many organisations spend hours comparing software prices but almost no time checking what those tools do with customer data.

That can become an expensive mistake.

A low-cost analytics plugin, chatbot or marketing widget may quietly collect personal information, transfer it to third parties or install tracking cookies without your knowledge.

The technology isn't the problem.

Not understanding your compliance obligations is.

Before adding another tool to your website, ask:

✓ What data does it collect?

✓ Where is it stored?

✓ Is it covered by my Privacy Notice?

✓ Do users need to consent?

Small checks today can prevent major compliance issues tomorrow.

31/12/2021

Dear Parents and Educators,

Thank you for an amazing experience in 2021.

Here's to more wins in 2022.🤗

Dear Parents, Guardians and Educators,How good is your eyesight?Look at the image below and type out the hidden words....
27/07/2021



Dear Parents, Guardians and Educators,

How good is your eyesight?

Look at the image below and type out the hidden words.

We have airtime up for grabs!🤑

1)Technology Transforming Learning50% of students, ages 10 to 18, go online for homework help, at least once a week.2) T...
26/03/2021

1)Technology Transforming Learning

50% of students, ages 10 to 18, go online for homework help, at least once a week.

2) Technology Transforming Teaching

91% of administrators say that effective use of , is critical to their mission of high student achievement.

Address

SW8/1127 Old LAGOS Road, Challenge
Ibadan

Opening Hours

Monday 08:00 - 17:00
Tuesday 08:00 - 17:00
Wednesday 08:00 - 17:00
Thursday 08:00 - 17:00
Friday 08:00 - 17:00
Saturday 10:00 - 14:00

Telephone

+2348150272479

Website

Alerts

Be the first to know and let us send you an email when KidswithoutABox posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The School

Send a message to KidswithoutABox:

Shortcuts

Share

Category