BYOD Policies for South African Schools.

Published: 10 November 2026  |  By AOLC

Most South African schools cannot buy a device for every learner, so "bring your own device" (BYOD) is tempting: learners arrive with phones, tablets and laptops, and the school stops paying for hardware it cannot afford to replace. But a BYOD programme without a written policy quickly turns into a free-for-all — devices of every age and condition on the same Wi-Fi as the school's admin systems, no agreement on who is responsible when something breaks, and no answer when a parent asks what the school does with their child's data.

A good BYOD policy is not long. It is a short, plain-language document that the school governing body adopts, parents sign, learners can actually understand, and the school's IT support can enforce on the network. This guide covers what to put in it.

Decide Whether BYOD Is Right for Your School.

BYOD is not an all-or-nothing choice. Before you write a policy, decide what problem it solves. Schools typically land in one of three models:

• Full BYOD — learners use their own devices in class for most subjects. Works best in well-resourced schools with strong Wi-Fi and a high share of families who can afford a suitable device.
• Supplemented BYOD — the school runs a lab or a device trolley for learners who do not have a device, and allows personal devices alongside it. This is the most realistic model for most South African schools, because it avoids a two-tier classroom.
• Restricted use — personal devices are allowed only for specific lessons or grades, for example senior phase and FET learners doing research or CAT and IT coursework.

Whichever model you choose, equity comes first. If a lesson depends on a personal device, the school must provide an alternative for learners who do not have one. If you are still planning your lab or classroom setup, see our guides to building a CAT lab that actually works and the best IT setup for schools.

What Your Policy Must Cover.

Keep each section short and written so a Grade 8 learner and their parent can both follow it. At a minimum:

• Who and what is covered — which grades, which device types, and a minimum specification (for example a recent operating system that still receives security updates, and a screen big enough for the work).
• Acceptable use — tie it to the school's existing code of conduct, so a BYOD breach is handled through the same disciplinary process as any other.
• Security requirements — a screen lock, an up-to-date operating system, and security software where the device type supports it. Devices that fail these checks are not connected.
• Network rules — personal devices connect only to the guest or BYOD Wi-Fi. No device may be plugged into the school's wired network or admin systems, and no learner may run their own hotspot, router or VPN to bypass school filtering.
• Responsibility and loss — state plainly that the school is not liable for loss, theft or damage to personal devices, and what learners should do with devices during break, sport and when not in use.
• Charging and power — learners arrive with a charged device. The school does not provide charging for every device, which matters during load shedding.
• Consequences — a graded response, from a warning through to losing network access, handled under the school's code of conduct.

Get Parents On Board in Writing.

Have the parent or guardian and the learner sign the policy before a personal device is connected. The signed agreement should confirm that they have read the rules, accept the school's right to limit or remove network access, and understand that the school does not accept liability for personal devices.

It should also say, in plain words, what the school monitors. Most schools filter web traffic and log which device connected to the Wi-Fi and when. If you do that, tell parents and learners up front. Under the Protection of Personal Information Act (POPIA), a school that processes a child's personal information needs the consent of a competent person, usually the parent or guardian, unless another lawful ground applies, and it must be open about what it collects and why. Ask your legal adviser to review the final wording.

Protect Learner Data on Personal Devices.

BYOD flips the usual security model: the school no longer controls the device. So control what the device can reach instead.

• Learner records stay on school systems. Teachers must not save class registers, marks or learner contact details to personal phones, personal cloud accounts or USB drives. That applies to staff using their own devices just as much as to learners.
• Use school accounts, not personal ones. Give learners and teachers school-managed accounts for classwork, so work can be accessed, recovered and removed when someone leaves. Our guide to POPIA and cloud storage explains the responsibilities that come with storing data in the cloud.
• Add multi-factor authentication for staff. A teacher logging in to the school management system from a personal phone is a much bigger risk than a learner browsing the web. See why MFA is non-negotiable.
• Report lost devices quickly. If a staff device holding school data goes missing, the school must know straight away, because a loss of personal information may need to be reported under POPIA.

Build the Network to Match the Policy.

This is where most school BYOD programmes fail. The policy says personal devices must stay off the admin network, but the school only has one Wi-Fi network. The fix is to separate what personal devices can reach, as we describe in our guide to school network security.

• A separate BYOD SSID — internet-only, with no route to the admin or academic networks.
• Individual sign-in — so you know which learner or teacher is using which device, rather than one shared password that every learner has by the second week.
• Content filtering — the same filtering your school applies elsewhere, so learners see the same rules on their own device.
• Bandwidth limits — so a few learners streaming video cannot slow every classroom. This matters on the typical school fibre or wireless link, so check that your connectivity can carry the extra load.
• Enough access points — a classroom of 35 learners, each with a phone and a laptop, can mean 70 connections in one room. Consumer-grade Wi-Fi will not cope; see our networking range for business-grade equipment.

Plan for Load Shedding and Support.

BYOD adds two practical problems that policies often forget. The first is power: a device that is flat by mid-morning is useless, so lessons should never depend on a learner's battery, and the school should tell families that devices must arrive charged. Putting the switches and access points on UPS power keeps the Wi-Fi running when the lights go out — see what load shedding means for your IT infrastructure.

The second is support. Decide now what your IT support will and will not do. A sensible line: the school helps a learner connect to the Wi-Fi and reach their school account, but it does not repair or configure personal devices. Without this line, your teachers become the unofficial helpdesk for every phone in the school.

---

Your BYOD Policy Checklist.

• Choose the model — full, supplemented or restricted BYOD — and provide school devices for learners who have none.
• Write a short policy and have the school governing body adopt it, tied to the code of conduct.
• Get a signed agreement from the parent or guardian and the learner, including what the school monitors.
• Set minimum device standards: supported operating system, screen lock, security software.
• Separate the network: a BYOD SSID with individual sign-in, filtering and bandwidth limits.
• Keep learner data off personal devices and use school-managed accounts instead.
• Add MFA for staff who access school systems from any personal device.
• Define the support boundary so your teachers are not the helpdesk.
• Plan for power: UPS for the network, charged devices on arrival.
• Review every year as devices, apps and threats change.

If you would like help turning this checklist into a network your school can rely on, our education and classroom solutions teams work with South African schools every day, and our cyber awareness training helps teachers and learners recognise the risks a personal device brings.

← Back to Blog