Sharing Children's Photos at Your Daycare: Parent Consent and UU PDP Rules in Indonesia

Is a Child's Photo Really Personal Data Under Indonesian Law?

Yes. Indonesia's Personal Data Protection Law, UU PDP No. 27 of 2022, treats information about a child as personal data, and a photograph that identifies a child falls squarely within it. The law places children's data in a protected category and requires operators to process it with extra care and with the consent of a parent or guardian (Article 25).

The two-year transition period ended on 17 October 2024, so every enforcement provision now applies. A dedicated supervisory agency is expected to be operational during 2026, with powers to issue warnings, order data deletion, and impose administrative sanctions. For a daycare, TK, or PAUD operator, this means the casual habit of snapping photos and posting them to a group chat now carries real regulatory weight.

This is not only a legal question. Parents increasingly ask where their child's photos go, who can see them, and whether they can be removed later. Getting this right protects your center and builds trust at the same time.

What Does UU PDP Require Before You Take or Share a Photo?

Consent under the law is specific, informed, and freely given. A blanket line buried in an enrollment contract is weak. Strong consent covers four things.

First, purpose. State exactly what each photo will be used for, whether that is an internal learning record, a private update to the child's own parent, or public marketing. Second, language. Provide the consent request and privacy notice in Bahasa Indonesia so parents genuinely understand what they agree to. Third, the right person. For a child, consent comes from the parent or legal guardian, not the child. Fourth, the right to withdraw. Parents can change their mind, and your process must let them pull consent for future use without friction.

Treat marketing consent as separate from day-to-day parent updates. A parent may happily receive daily photos of their own child while refusing to have that child appear on your social media. Bundling the two into one checkbox is exactly the kind of shortcut the law is designed to stop.

Why Are WhatsApp Group Photos a Compliance Risk?

Shared WhatsApp or messaging groups are the most common way Indonesian centers distribute photos, and they are also the hardest to defend. In an open class group, every parent sees every other family's child. You have no record of who consented to that, and one photo can be forwarded, screenshotted, or reposted in seconds, entirely outside your control.

Consumer messaging apps were not built for institutional sharing of children's images. There is no consent log, no way to deliver a photo to one family only, and no reliable way to delete an image once it has spread. If a parent withdraws consent, you cannot claw the picture back from twenty other phones.

None of this means messaging apps are banned. It means they are the wrong tool for photos of children. Keep group chats for logistics like closure notices and reminders, and move anything showing a child to a channel you can actually control.

How Do You Build a Photo Consent Process That Holds Up?

A defensible process does not need to be complicated. Five steps cover most centers:

1. Collect written consent at enrollment, with separate, tickable options for internal records, private parent updates, and public marketing. 2. Record who consented, to what, and on what date, so you can prove it later. 3. Deliver each child's photos only to that child's family, not to a shared audience, unless every visible family has agreed. 4. Give parents a simple way to withdraw consent, and apply it to future use immediately. 5. Write a short staff policy so every teacher knows what may be photographed, where it may be sent, and what is never allowed.

Review consent at least once a year and whenever a child changes rooms or programs. Store the records where your admin team can retrieve them quickly, the same discipline that keeps you ready for a Dinas Pendidikan inspection applies here.

How Does a Secure Parent App Change This?

A dedicated parent app closes most of the gaps that group chats leave open. Photos and daily updates go to each child's own family through the parent app rather than a broadcast list, so one family never sees another family's child by default. Consent can be recorded against each family, and when a parent withdraws it, you stop sending, without chasing screenshots across a dozen devices.

Happy Kamper is built for this. Attendance, daily updates, and parent communication run through the parent app, staff app, and admin dashboard, so a photo reaches the right parent instantly and stays inside a channel you manage. That is the difference between hoping a WhatsApp forward never happens and being able to show, on request, exactly who received what.

The operational win matters too. Structured updates through one app replace the scramble of managing several class groups, and they give you the consent trail that UU PDP expects. You can see how this fits a preschool or daycare on the early education solutions page.

What Should Operators Remember?

A few points are worth carrying into your own policy. A child's photo is sensitive personal data under UU PDP 27/2022, and enforcement has been fully active since 17 October 2024. Before capturing or sharing a child's image, you need explicit, informed consent from a parent or guardian, given in Bahasa Indonesia.

Keep marketing consent separate from private parent updates, and let families withdraw consent at any time. Open WhatsApp groups give you no consent record and no control once a photo is forwarded. A secure parent app delivers photos per family, tracks consent, and gives you an audit trail you can stand behind.