Compliance & Returns: Statutory exports for KEMIS, NEMIS, UNEB, WAEC and other regulators

+$1.48/mo at 500 students. Free instant access, no credit card required.

Works with

EduPrime Core

Compliance & Returns in the EduPrime: Statutory exports for KEMIS, NEMIS, UNEB, WAEC and other regulators

The return, defined once

A profile per return: which fields it wants, where each comes from in your data, and what format the ministry accepts. Defining it is the only hard part, and it is done once rather than every submission window.

Twelve country packs, seeded

Kenya’s KICD CBC competency progress and NEMIS. Nigeria’s JAMB, WAEC, NECO and UBEC. South Africa’s NSC matric submission and SA-SAMS. Uganda’s EMIS and UNEB, Tanzania’s NECTA, Rwanda’s NESA, Ghana’s CSSPS, Ethiopia’s EMIS, the UK’s DfE census and CIPFA, Australia’s NAPLAN, the USA’s Ed-Fi and OneRoster, India’s UDISE+ and CBSE. Real returns, already described.

Your field, their field

The field map is the heart of it. A ministry wants LEARNER_SURNAME; you hold the pupil’s surname. Map it once and every future return in that pack is correct by construction.

A breach register that starts on time

Section 43 gives 72 hours. The record carries severity, the pupils affected, what was done and whether the Commissioner and the parents were told. The value is in having somewhere to write it down at the moment it happens, at 4pm on a Friday.

Consent, per purpose, per child

Parental consent is not one signature at enrolment. This records which purpose the parent agreed to, when, and through what — so withdrawing consent for photographs does not accidentally withdraw it for the school bus.

How long, and what happens then

A retention policy per record type: how long it is kept, on what basis, and what happens at the end. Keeping a child’s file for ever is the most common breach a school commits, and it is committed by default.

Breaches, with the deadline on the record

What happened, what was affected, what was done and whether NITDA and the affected people were told. The deadline sits on the record so it cannot quietly pass while the incident is being discussed.

Subject access requests, on the clock

A parent asks what you hold on their child. The request is logged with its deadline, what was asked, and what was sent back — so the response is evidenced, not just remembered.

Categories and purposes, declared

What kinds of personal data the school holds, why it holds each kind, and on what lawful basis. Writing this down once is what turns the other three registers from paperwork into something that can actually be checked.

Access requests, against their deadline

A request to see what you hold, logged with its deadline, its content and the response sent. The evidence that you answered is as important as the answer.

The Article 30 register, properly filled in

Each processing activity with its purpose, lawful basis, the categories of data subject and personal data, recipients, transfers outside the EEA and its retention period. A school typically has twenty or thirty of these — enrolment, safeguarding, fee billing, payroll, photographs, the bus — and they are all in one list.

DPIAs where the risk warrants one

Article 35 wants an impact assessment before high-risk processing. The record holds the risk, the mitigation, the residual risk and the sign-off, so the assessment exists before the system goes live rather than being written afterwards to satisfy an auditor.

Subject requests on the one-month clock

A parent asks for everything you hold on their child. The request, its deadline, what was provided and when are all on one record — which is what turns “we responded” into something you can show.

What's inside

Everything in Compliance & Returns

43 items in 12 areas, every one shipping with the app today.

Everything a registrar needs to stay compliant, nothing they don't.
- 12 country packs, ready to runPre-built profiles for Kenya, Uganda, Tanzania, Rwanda, Nigeria, Ghana, South Africa, Ethiopia, UK, Australia, USA and the Middle East — NEMIS, UNEB, WAEC, SA-SAMS and more.
- Any format an agency asks forGenerate CSV with UTF-8 BOM, multi-sheet Excel, XML, JSON, PDF or a zipped bundle — with configurable encoding, delimiter and file-format version per return.
- Validate before you submitRegex, required-field, length, range, uniqueness and Python rules catch bad data first — errors block the file, warnings flag it, so nothing gets rejected at the portal.
- Deadline calendar & auto-submitEvery due date on one calendar — upcoming, due-soon, overdue — while a scheduler generates and e-mails each return on time and logs the agency's receipt.
Data Compliance
- ROPA (Art.30)
- Data Categories
- Data Subjects
- Processing PurposesOpens as a list or form.
- Consent
- Subject Requests
- Breaches
- DPIAs
Returns
- Submitted Returns
- Failed Runs
- Validation Errors
- Acknowledgments
Configuration
- Field Mappings
- Submission Addresses
- Country Packs
- Settings
Compliance & Returns
- Calendar
- Templates / Profiles
- File Format Changelog
Data-Protection Compliance (ODPC)
- Registration Packets
- Breach Incidents
- Parental Consents
- Audit Log
Documents it prints
- Data-Protection Registration Packet (ODPC)
It runs by itself
- Data protection: check 72-hour breach deadlinesRuns hourly
Roles it ships
- User
- Data Protection Officer
Guided assistants
- Data-Breach Notification Wizard (ODPC)
What it sends
- Data-Breach Notification (ODPC)
- Data Subjects — Breach Notification
More in this app
- Security compromises, and who was toldPOPIA calls it a compromise rather than a breach, and it must be notified to the Regulator and to the affected people. The record carries what happened, who was affected and the state of both notifications.
- Every submission, keptWhat was sent, on what date, and whether it was accepted. When the ministry says the return was late or wrong, the answer is a record rather than an argument — and the failed runs are listed separately with the reason they did not validate.
- When each one is dueA calendar of return deadlines, and a changelog for when a ministry republishes a file format — which happens, usually without notice, and is otherwise discovered when a submission is rejected.
- The registration packet, assembledData controllers and processors register with the ODPC. The packet is held as a record — what was declared, by whom and when — so the next renewal starts from what you actually submitted rather than from memory.
- Who you hold data aboutA data subject record per person — pupils, guardians, staff — with the categories held and the consents given. It is the register that makes every other question answerable, and the one schools most often do not have.
- The data subject registerPupils, guardians and staff, with the personal information held about each and the consents given. Under POPIA the subject has rights against this register; without the register the rights cannot be honoured on request.
- Categories, purposes and consentWhat personal information the school holds, why, on which of the Act’s lawful bases, and who consented to what. This is the part that makes an audit short.
- The breach register and its 72 hoursWhat happened, which subjects and which data, the risk to them, and whether the authority and the subjects were told. Written at the time, by whoever noticed, in the place the DPO will look.
- Subjects, categories and purposes underneathThe supporting registers the ROPA points at — who the data subjects are, which categories of data you hold including the special ones, and the purpose and lawful basis for each. Get these right and the ROPA maintains itself.

Works with

What Compliance & Returns works with

Compliance & Returns shares one database with the rest of the EduPrime and BridgeERP: these are the apps it already talks to, with nothing to buy in between.