What Your Centre Must Delete When a Child Leaves, and When

UU 27/2022 leaves much of its procedural detail to implementing regulations, so the mechanics described here may move. Confirm the position before you rely on it.

Whose data is it once the child has left?

A family left eighteen months ago and their child's photographs, allergy notes and a parent's phone number are still on the class tablet and in an old WhatsApp group. Under Indonesia's personal data law that is not archiving, it is still processing, and the permission you had ran out when the purpose did.

The law is UU 27/2022, and it classifies children's data as specific personal data, the same tier as health records and biometrics. A class list carrying a birthdate and an allergy note is therefore the most heavily regulated kind of record the statute defines, not an ordinary contact detail.

That classification is also why the consent you took at enrolment belongs to the parent rather than to the file. Processing a child's data requires the consent of the parent or guardian, and consent given for a term of swimming lessons does not stretch to keeping the photographs three years later.

The law never tells you how many years

Owners wait to be handed a retention period and it never arrives. What UU 27/2022 does instead is harder, because where processing rests on consent you have to state the retention period of the documents holding the data at the moment you ask for it.

The number is yours to set and to defend, and it has to exist in writing before the first parent signs anything. A centre with no stated period has already missed a requirement that costs nothing to meet.

Set it by purpose rather than by comfort, one line per record type. Attendance and progress notes support a claim about what a child was actually taught, so they justify a period that runs from the last class; a photograph used in a campaign serves a purpose that ends when the campaign does.

The test is whether you could say out loud what the record is still for. A phone number sitting in a class group for a term that finished has no answer to that question, and neither does a folder of unused photographs.

What is the difference between deleting and destroying?

The statute uses two words and hangs different triggers on each. Deletion becomes mandatory where the data is no longer needed for its purpose, where a parent withdraws consent, where a parent asks, or where it was obtained unlawfully.

Destruction is the narrower duty and it attaches to a retention period running out under an archive schedule, to a parent's request, and to the record not being tied up in a legal proceeding. The working reading is that deletion takes a record out of use while destruction puts it beyond recovery.

Both end in the same obligation, and it is the one centres forget. You have to tell the parent that the deletion or destruction has happened, which means you need to know where every copy lives before you can honestly say the record is gone.

Purpose is the word doing the work in every one of those triggers. Attendance records support a claim about a term that was delivered, a medical note supports keeping a child safe in the room, and a marketing photograph supports a campaign, so when the term, the enrolment or the campaign ends, the ground for holding that record ends with it.

How long do you have when a parent asks?

Three days, and the clock sits in the law rather than in your service standard. A request for access to what you hold, and to the trail of what you did with it, has to be answered within 72 hours of arriving.

Withdrawal of consent runs on the same clock. Once a parent withdraws, processing has to stop within 72 hours, which in a centre of four staff means somebody has to see the message on the day it lands rather than at the end of the week.

That makes it a staffing decision more than a legal one. Name one person and one address that receives these requests, tell parents at enrolment which address it is, and log the date each request arrives, because the deadline runs from receipt and not from the day it reached the right desk.

A request also rarely announces itself as one. A parent asking you to take a photograph down from Instagram, or to stop sending them class messages, is exercising a right whether or not the law is mentioned, and the clock starts from that message rather than from the moment somebody recognises what it was.

Your software vendor is not the one on the hook

You moved the records into an app two years ago, and that changed where they live rather than who answers for them. Processing carried out by a processor on the controller's instructions remains the controller's responsibility, so the parent's request still lands on the centre.

Happy Kamper holds the records this question is about. Child profiles with medical records and emergency contacts, attendance with timestamps, daily updates covering photos, videos, activity logs, meal logs and progress notes, and the messages sent to parents sit in one place, which is what makes a request answerable at all instead of a hunt across three phones. Holding the records is not the same as discharging the duty: the platform does not produce a filing in an official government format, and the decision about what goes and when stays with the centre.

Knowing where the copies are is most of the work anyway. Records inside a system are the ones you can find; the copies on a personal phone, in an exported spreadsheet or in a group chat are the ones that turn the notification in the previous section into something you cannot honestly send.

What has to happen if something leaks?

A protection failure starts a written notice, not a meeting. The statute is firm on three points: you have 72 hours, the notice goes to both the parent and the supervisory body, and it must say what was exposed, when and how it happened, and what you are doing about it.

Those three contents are the whole template, so write it before you need it. A centre drafting that notice on a quiet Tuesday will produce something far better than one drafting it on the afternoon a tablet goes missing.

What is not settled is where that notice actually goes. The supervisory body the law names is one the President establishes, and the statute leaves both that body and the procedure for exercising its powers to implementing regulations.

So the deadline and the three contents are fixed in the statute and you can prepare against them today. The filing channel is the part to confirm with a professional rather than infer.

A week's worth of work, in order

None of this needs a consultant to begin. Write down what you hold and why, one line per record type, then mark what you actually have against each line. Two or three categories will turn out to have outlived their purpose years ago, and the orphaned ones usually announce themselves on the first pass.

Then set the period for each, put it in the enrolment form, name the person who receives requests, and draft the breach notice. Breaching the deletion, notification and record-keeping duties carries administrative sanctions, with the fine capped at two per cent of annual revenue, so the exposure scales with the centre rather than sitting at a flat figure.

The order matters more than the speed. A centre that has written down its periods and named its person can answer a parent in an afternoon, and one that has done neither will spend that afternoon working out who has the photographs.