Status of this document

This is a draft framework. It sets out the safeguards that are built into LEAP by design and that inform how the platform protects children’s and teachers’ data. It is not yet an adopted policy of Freetown City Council, and it has not yet been validated by the Municipal Education Data Safeguards Coalition, which does not currently exist and is proposed for establishment after the LEAP Phase 0 soft pilot closes on 31 August 2026. Where this framework describes a control that is already in operation, it says so. Where it describes a control that is planned or proposed, it says so plainly. Nothing here should be read as a claim that planned work has already been completed, or that the framework already carries the force of municipal policy.

A note on legal alignment. This framework is designed to align with the Universal DPI Safeguards Framework, with the African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention, and with generally recognised principles of responsible data governance. It is also intended to align with applicable Sierra Leone law on data protection, child protection, and access to information. The precise legal instruments, their current status, and their application to this specific processing of children’s data require formal legal assessment, which has not yet been completed. This document therefore identifies where legal verification is still required, and it does not assert compliance with any law that a qualified legal assessment has not yet confirmed.

1. Purpose

The purpose of this framework is to set out how children’s and teachers’ data will be protected, governed, and made accountable within the municipal education digital public infrastructure that Freetown City Council operates through the LEAP partnership. The framework exists to make sure that a system built to help children is never turned against them, that the people whose data it holds are treated with care and given a voice, and that the responsibilities for protecting them are clear, assigned, and auditable. It translates the high principles of safe and inclusive digital public infrastructure into rules that the people running Freetown’s schools can actually follow.

2. Scope

This framework applies to all personal data about children, caregivers, and teachers that is collected, processed, stored, or shared through the p-Hive platform and the wider LEAP operating model, across Freetown City Council’s municipal schools. It covers the data itself, the platform that holds it, the people who handle it, and the routines through which it is validated, approved, and acted on. It applies to Kulea Hive as the platform builder and processor, to Freetown City Council as the data owner and controller, and to every user provisioned on the system. It applies across the current Phase 0 pilot and is designed to govern the system as it grows into wider operation. It does not replace Freetown City Council’s statutory responsibilities or any applicable national law; it sits beneath them and gives them practical effect in this specific system.

3. Definitions

For the purposes of this framework, the following terms carry the meanings given here.

Affected person. Any individual whose data is held in the system, or who is directly affected by a decision the system supports, principally a learner, a caregiver, or a teacher.

Data Controller. Freetown City Council, the public authority that owns the municipal education data, decides the purposes for which it is processed, and is accountable for acting on it.

Data Processor. Kulea Hive, which builds, operates, and safeguards the platform and processes data on behalf of the Data Controller, without owning it.

Coalition. The Municipal Education Data Safeguards Coalition, a multi-stakeholder body proposed for establishment after 31 August 2026 to provide oversight of safeguarding across the system.

DPI. Digital public infrastructure, meaning shared digital systems that deliver public services at scale under public governance. LEAP, powered by p-Hive, is treated here as a sectoral education deployment of DPI.

Personal data. Any information relating to an identified or identifiable person.

Sensitive data. Personal data whose misuse carries heightened risk of harm, including data about children, data on vulnerability, disability, or safeguarding status, and any at-risk classification.

Processing. Any operation performed on personal data, including collection, entry, validation, storage, analysis, display, sharing, retention, and deletion.

4. Guiding Principles

This framework is guided by a set of principles drawn from the Universal DPI Safeguards Framework and adapted to the reality of a system holding children’s data in Freetown’s schools.

The best interests of the child come first. Where any tension arises between operational convenience and a child’s welfare, the child’s welfare prevails.

Do no harm. The system is designed to anticipate and prevent harm to the people whose data it holds, not only to deliver a service.

Do not exclude. No child should be disadvantaged because of how the system works, and alternative, non-digital routes to support remain available.

Protect privacy and security by design. Data protection is built into the platform rather than added afterwards, and it is maintained as the system evolves.

Keep humans in charge. Any analysis or risk flag supports a professional’s judgement and never replaces it. No consequential decision about a child is made by the system alone.

Be transparent and accountable. How the system uses data is explained in plain terms, and every action is traceable to an accountable role.

Give people a voice and a remedy. The people affected by the system help shape its safeguards and have a clear, safe way to raise concerns and seek redress.

Govern inclusively. The people most affected, including women, young people, and people with disabilities, take part in how the system is governed.

Build to last. Safeguards are designed to be sustained on a municipal budget and embedded in routine, not dependent on any single project.

5. Safeguarding Objectives

The framework pursues a small number of clear objectives. To protect the privacy, safety, and dignity of every child, caregiver, and teacher whose data the system holds. To keep the data accurate, secure, and used only for the purposes for which it was collected. To ensure that decisions supported by the system remain in human hands and serve the child. To give affected people genuine influence over the safeguards and a real remedy when something goes wrong. To make the whole arrangement transparent and accountable to the communities it serves. And to embed all of this durably in how Freetown City Council governs its schools.

6. Roles

Responsibility for safeguarding is distributed across defined roles, so that no single person or organisation holds unchecked power over children’s data.

Freetown City Council is the Data Controller and the accountable public authority. It owns the data, approves what becomes official, adopts this framework as policy, and acts on what the system shows.

Kulea Hive is the Data Processor and platform custodian. It builds, operates, and safeguards p-Hive, provisions and monitors access under audit, and processes data strictly on the Council’s behalf, without owning it.

The proposed Municipal Education Data Safeguards Coalition is the oversight body. Once established, it validates and monitors the safeguards, gives affected communities a defined role, and holds an annual public account.

The proposed Information Governance Lead and Safeguarding Lead are named individuals who will hold day-to-day responsibility for data governance and child safeguarding respectively. These roles are planned and not yet filled.

School leaders and school-level bodies, including School Management Committees and Boards of Governors, verify their own school’s information and represent the school community.

Affected people, meaning learners and caregivers, are the people the framework exists to protect, and are given a role in shaping the safeguards that concern them.

7. Responsibilities

Each role carries specific responsibilities. Freetown City Council is responsible for the lawful basis of processing, for approving official data, for adopting and enforcing this framework, and for ensuring that the intelligence the system produces is acted on responsibly. Kulea Hive is responsible for building and maintaining the platform’s security controls, for provisioning access strictly by role and school, for keeping the audit trail complete, for supporting validation, and for operating the grievance and consent mechanisms once built. The Coalition, once established, is responsible for scrutinising the safeguards, surfacing community concerns, and reviewing the framework annually. The Information Governance and Safeguarding Leads, once appointed, are responsible for the everyday application of data-protection and child-protection rules and for being the first point of contact when a concern arises. School leaders are responsible for verifying their own school’s data and for helping information reach families. Every user is responsible for using the system only within their assigned role and scope.

8. Risk Categories

The framework recognises the categories of risk that a system holding children’s data must manage, drawing on the risk taxonomy of the Universal DPI Safeguards Framework.

Privacy risk, where children’s or teachers’ data is accessed, shared, or used without authority or beyond its purpose. Safety risk, where a security weakness or a data exposure places a person in physical or emotional danger, which is a particular concern for vulnerable children. Exclusion and discrimination risk, where the system disadvantages girls, children with disabilities, children in low-connectivity settings, or other underserved groups. Recourse risk, where an affected person has no way to question or challenge how their data is used. Data-quality risk, where inaccurate or incomplete data leads to a wrong decision about a child. Institutional risk, where weak capacity or unclear accountability undermines the safeguards. Sustainability risk, where the safeguards cannot be maintained beyond a project. And responsible-use risk, where analytics or risk flags are misread as automated judgements about children rather than as decision support.

9. Risk Management

Risks are identified, assessed for likelihood and impact, mitigated, and reduced to a residual level with a named owner. Risk management is not a one-off exercise; it runs continuously and is reviewed by the Coalition once established. The proposed Data Protection Impact Assessment for p-Hive is the primary instrument for identifying and prioritising risks at the outset of the safeguards work. Each identified risk is assigned a mitigation and an owner, and the highest-priority risks feed the time-bound safeguards roadmap. Existing controls already reduce several of these risks today, as described in the sections that follow. New controls, principally the grievance mechanism, the consent package, and the appointment of the governance and safeguarding leads, are proposed to close the gaps that current controls do not yet cover.

10. Data Governance

Data governance rests on the separation of duties that already defines LEAP and is a genuine strength of the system as it stands. Freetown City Council owns the data and decides what becomes official. Kulea Hive builds and safeguards the platform without owning the data. Access is never self-granted; every account is created and scoped by the platform custodian, and there is no self-registration. This controlled provisioning model is in operation today. On top of it, the framework adds data minimisation, meaning only data that is necessary is collected; purpose limitation, meaning data is used only for the purposes for which it was collected; and defined retention and deletion rules, so that data is not kept longer than needed. The lawful basis for processing children’s data is to be confirmed by formal legal assessment against applicable Sierra Leone law, and is not asserted here.

11. Privacy

Privacy is protected by design. Several controls are already in operation in p-Hive: school-level data isolation, so that each school sees only its own learners and staff; role-based access with server-side authorisation, so that permissions are enforced by the system rather than trusted to the user’s device; and encryption of data in transit and at rest. These are existing controls, not aspirations. Planned enhancements, which are not yet complete and are described as forthcoming, include multi-factor authentication for privileged users and the migration of privileged accounts to fully managed organisational identities. The framework commits the system to collecting the minimum data necessary, to limiting who can see sensitive information, and to keeping learner-level data out of the reach of anyone whose role does not require it.

12. Transparency

Transparency means that the people whose data the system holds can understand, in plain language, what is collected, why, who can see it, and how it is used. The framework commits Freetown City Council and Kulea Hive to publishing an accessible explanation of the system’s data practices, written for caregivers rather than for lawyers. It commits the proposed Coalition to publishing its terms of reference, its decisions, and an annual safeguarding report. And it commits the partnership to being candid about the difference between what is in place today and what is planned, so that transparency extends to the honest status of the safeguards themselves. Transparency is treated here as a foundation of trust, not a public-relations exercise.

13. Consent

Consent and transparency arrangements appropriate to the school context are a proposed deliverable of the safeguards work, to be developed with Freetown City Council and the Coalition and subject to legal review. The framework recognises that consent for children’s data is a matter of both law and ethics, and that it must be handled carefully in a context where caregivers may have limited literacy or limited familiarity with digital systems. The proposed consent and transparency package will set out on what basis children’s data is processed, how caregivers are informed, what choices they have, and how those choices are recorded and respected. Until that package is developed and the lawful basis is confirmed by legal assessment, the framework does not claim that a compliant consent regime is already in place.

14. Human Oversight

A defining commitment of this system is that data becomes official, and decisions about children are taken, only through human judgement. This is already how LEAP operates: validated data is confirmed by people and approved by the Data Authority before it becomes the official source of truth, and the at-risk logic in the platform is transparent and human-reviewed. The framework holds the system to this standard explicitly. Any analytics or risk flags are decision-support tools for educators, not automated verdicts about children. No child is labelled or acted against by the system alone. A professional always stands between the data and the decision, and remains accountable for it.

15. Accountability

Accountability is made real by an auditable model in which every action is traceable to an accountable role. Full audit logging of access and changes is already in operation in p-Hive. The separation of duties means that the party operating the platform cannot also declare data official, so power is checked rather than concentrated. The framework adds named responsibility through the proposed Information Governance and Safeguarding Leads, and independent scrutiny through the proposed Coalition. Accountability runs in more than one direction: from Kulea Hive to Freetown City Council, from the Council to the communities it serves, and from the whole system to the affected people who sit on the Coalition and can hold it to account.

16. Incident Management

The framework commits the partnership to a defined process for handling data-protection and safeguarding incidents, which is a proposed deliverable to be finalised with Freetown City Council. The process will cover how an incident is detected, reported, contained, assessed, and resolved, who must be informed and how quickly, and how affected people are supported and told what has happened where appropriate. Safeguarding incidents involving a child will be handled under the child-safeguarding protocol and escalated to the Safeguarding Lead. The audit trail that already exists supports incident investigation. Until the incident-management process is finalised and the responsible leads are appointed, the framework describes this as planned rather than operational.

17. Grievance and Redress

A grievance and redress mechanism for learners and caregivers is a proposed deliverable of the safeguards work and a priority of this framework, because effective remedy is a foundational principle of safe digital public infrastructure and is currently the clearest gap in the system. The mechanism will give an affected person a clear, accessible, and safe way to raise a concern about how their data is used, to question a decision that affects them, and to seek a remedy, without fear of reprisal. It will be co-designed with community actors and with caregivers themselves, because a redress process built without its users tends not to work. It will define how a concern is received, who handles it, how quickly it is resolved, and how the outcome is communicated. It does not yet exist, and the framework is candid that building it is part of the proposed work rather than a control already in place.

18. Monitoring

Monitoring draws much of its data from the system itself, as a by-product of normal use, which reduces reporting burden and improves reliability. System timestamps, sign-off logs, access logs, and, once built, records from the grievance mechanism, provide evidence of how the safeguards are performing. The framework commits the partnership to a small set of safeguarding indicators, to be agreed with the Coalition, covering matters such as the existence and reach of the grievance mechanism, the timeliness of responses to concerns, the completeness and accuracy of data, and the inclusion of underserved groups. Monitoring is continuous, and its findings feed the annual safeguarding report and the framework’s own review.

19. Continuous Improvement

The framework is designed to learn and improve rather than to sit unchanged. Lessons from monitoring, from incidents, from grievances, and from the Coalition’s scrutiny are captured and used to refine the safeguards, the mechanisms, and the routines. Continuous improvement is deliberate: the system evolves, the risks evolve with it, and the safeguards must evolve too. This mirrors the iterative philosophy of the Universal DPI Safeguards Framework, which treats safeguards as living practices rather than a fixed checklist.

20. Review Process

This framework is subject to formal review. It will be reviewed at least once a year by the Coalition, once established, and additionally whenever a significant change to the system, the law, or the risk picture warrants it. The annual review considers how well the framework is being implemented, how the mechanisms are performing against the safeguarding indicators, and what needs to change. The review is also the point at which the framework’s version is updated and the changes are documented, so that everyone can see how it has evolved. As a draft, the current version anticipates its first substantive review to follow validation by the Coalition after 31 August 2026.

21. Governance Structure

Governance operates on three tiers, joined by the separation of duties. At the operational tier, Kulea Hive as platform custodian and Freetown City Council as data authority hold distinct roles, so that the party that operates the platform is not the party that declares data official. At the oversight tier sits the proposed Municipal Education Data Safeguards Coalition, co-chaired by Freetown City Council and Kulea Hive, with a community co-chair added after the first year, giving civil society, community bodies, and affected people a defined role in scrutinising and monitoring the safeguards. At the strategic tier, senior Council leadership provides direction and holds the partnership accountable. Named responsibility for data governance and child safeguarding is planned through the Information Governance and Safeguarding Leads. This structure keeps the public authority accountable, bounds the technical partner’s role, and builds in a deliberate shift of influence toward the community over time.

22. Implementation Roadmap

The framework will be implemented in sequence, aligned to LEAP’s phased rollout, on the understanding that each step is proposed rather than completed. In the inception phase, following the close of Phase 0 on 31 August 2026, the priority is to establish the Coalition, agree its terms of reference, and begin the Data Protection Impact Assessment. In the middle phase, the priority is to validate the framework, co-design and pilot the grievance mechanism, and develop the consent and transparency package, alongside appointing the Information Governance and Safeguarding Leads. In the final phase, the priority is to embed the safeguards in Freetown City Council’s routines, publish the first annual safeguarding report, and secure the framework’s adoption as municipal policy. The roadmap is deliberately sequenced so that governance and control are established before the system scales, rather than after.

23. Success Indicators

Success is judged against a small set of honest indicators, to be confirmed with the Coalition. A validated framework adopted as Freetown City Council policy. A functioning grievance mechanism that affected people know about and use, with concerns resolved within an agreed time. A consent and transparency package in place, with caregivers able to understand how their children’s data is used. A standing Coalition meeting on schedule, with genuine community and affected-person participation. Named Information Governance and Safeguarding Leads in post. A first annual safeguarding report published. And measurable attention to inclusion, so that girls, children with disabilities, and children in low-connectivity settings are not left behind. Each indicator describes an intended result of the proposed work, not an achievement already recorded.

24. Annexes

The following annexes are intended to accompany the framework as it is developed. They are listed here as planned components; those not yet produced are marked accordingly.

Annex A. Data Protection Impact Assessment for p-Hive. To be produced.

Annex B. Grievance and Redress Mechanism design and procedures. To be co-designed.

Annex C. Consent and Transparency package. To be developed, subject to legal review.

Annex D. Child-Safeguarding Protocol. To be finalised.

Annex E. Incident-Management procedure. To be finalised.

Annex F. Data retention and deletion schedule. To be developed.

Annex G. Coalition Terms of Reference. To be developed by the Coalition once established.

Annex H. Legal basis assessment for processing children’s data under applicable Sierra Leone law and alignment with the Malabo Convention. Legal verification required.

Annex I. Mapping of this framework to the Universal DPI Safeguards Framework principles and risks. To be completed.

Safeguarding is built into LEAP by design. From the outset, LEAP has treated the protection of children’s and teachers’ data as a core design requirement, and this framework is the written expression of that commitment. It is designed to align with internationally recognised data protection standards, including those reflected in the European Union’s General Data Protection Regulation, with Sierra Leone’s data protection framework, and with the African Union’s Malabo Convention on Cyber Security and Personal Data Protection, subject to formal legal review. As a living document, it will be formally validated, refined, and adopted through the Municipal Education Data Safeguards Coalition, giving communities and affected people a direct voice in how the system protects them.