Student pickup safety: protocol, risks, and checklist
· 9 min read
Student pickup safety is one of the criteria that weigh most on family trust — and one of the school’s biggest legal risks. This is not abstract safety: it is the moment the child leaves the school’s care and passes into the guardian’s care. If something goes wrong, the consequences are immediate and serious.
This guide summarizes what Brazilian law requires, the five highest-risk scenarios, and an auditable checklist for the gate — with links to the operational gate protocol, document-based release, and school access management.
What the law requires at student pickup (ECA, Civil Code, and LGPD)
Schools’ legal duty for student safety during school hours — including pickup — sits in a set of rules every administrator needs to know.
ECA — Statute of the Child and Adolescent
Article 70 of the ECA is clear: "It is everyone’s duty to prevent the occurrence of threats or violations of the rights of children and adolescents." For schools, this means maintaining active protection processes — not merely reacting after the fact.
Article 17 guarantees the right to physical, psychological, and moral integrity. Releasing a child to an unauthorized person is a direct violation of that right, with liability attributed to the guardian institution.
Civil Code — Strict liability
Article 932, item IV, of the Brazilian Civil Code establishes that educational institutions are strictly liable for damages caused by their students and, more broadly, for damages that occur under their responsibility. In practice, the school can be held liable for damages from an improper release even without intent — it is enough that adequate verification processes were not adopted.
That strict liability at pickup covers the handoff on campus. After authorized release, custody at the school passes to the family — but the school remains liable on field trips, school transport, and extra hours. See what the law covers when the student is off campus.
Strict liability: unlike fault-based liability (which requires proof of negligence), strict liability for schools does not require the family to prove negligence. It is enough to demonstrate the damage and the link to the institution. The burden of proving that adequate processes were adopted lies with the school.
LGPD — Data protection in the pickup process
Pickup control involves collecting and handling sensitive data: guardian photos, ID documents, access records. All of this is protected by Brazil’s General Data Protection Law (Law 13,709/18).
Schools must ensure: a legal basis for processing (usually legitimate interest or contract execution), secure encrypted storage, access limited to authorized personnel, and a retention period aligned with necessity — not indefinite.
5 legal risks that most expose the school at pickup
Based on the foundations above, these five scenarios most expose schools to liability:
1. Release to a person without documented authorization
The most critical and most preventable scenario. The school releases a child to someone who claims to be a relative, without checking a registry of authorized people. If the guardian contests, the school cannot prove the release was authorized.
2. Authorization via an untraceable channel
WhatsApp messages, voice notes, verbal communications — these channels have no legal standing as formal authorization. A message that "got lost" or was misinterpreted does not protect the school in a dispute.
3. No record of the pickup
Even if the release was correct, without a record of who picked up the child, when, and with staff confirmation, the school cannot prove what happened. Under strict liability, the burden of proof lies with the institution.
4. A process dependent on a single person
When the gate attendant who "knows all the families" is the only person backing the process, the school has a single point of failure. If they are out, the process stops — but the school’s responsibility does not.
5. Student data stored insecurely
Photos of children, authorized-pickup lists, and pickup records in unencrypted spreadsheets, WhatsApp groups, or systems without access control expose the school to LGPD sanctions on top of operational risks.
Quick references:
Art. 932 — Brazilian Civil Code — strict liability of educational institutions
Art. 70 — ECA — active duty to prevent threats to children’s rights
LGPD — Law 13,709/18 — student and guardian data are sensitive personal data
A legally robust pickup protocol: 6 elements
Legal protection at pickup does not begin at the gate — it begins in process design. A robust protocol has six non-negotiable elements:
Formal registry of authorized people with photo and ID, updated by the legal guardian
Identity verification with visual confirmation — not just name confirmation
Formal channel for one-time authorizations identifying the authorized person
Record of every pickup: who collected the child, time, and staff confirmation
Encrypted storage of data, compliant with the LGPD
Team training with a written protocol — not dependence on one person’s memory
What to avoid at all costs:
WhatsApp as the only channel for one-time authorizations
Gate attendant as the sole keeper of the process with no documented backup
Printed list without records of who picked up and when
Student data in spreadsheets without encryption or access control
A process that stops when someone is absent
For the full operational drop-off and pickup flow — steps, exceptions, and audit — see the school gate drop-off and pickup protocol. When a guardian arrives without a phone, the school needs a documented document-based release flow (CPF at the gate).
Student pickup safety checklist (audit-ready)
Use this checklist to confirm the protocol is complete — from the registry through LGPD — without relying only on the gate attendant’s memory.
Registry and identity
Authorized-people registry with photo and ID, updated by the legal guardian
Identity verification with visual confirmation (not name-only)
Documented document-based release flow when there is no app on the phone
Authorization and records
Formal channel for one-time authorizations (who, when, for whom) — WhatsApp not the only record
Record of every pickup: who collected the child, time, and staff confirmation
Documented exception flow (one-time authorization, late pickup, alternate guardian)
Operations and LGPD
Operational backup if the gate attendant is absent: written protocol + system access for another trained staff member
LGPD: legal basis, minimization, secure storage, and access control for sensitive data (photos, lists, logs)
Controlling who enters the school (turnstiles, biometrics, reception) does not replace controlling who leaves with the student. For that distinction and a technology map, see the guide to school access management.
Why families choose schools with controlled pickup
Beyond legal protection, pickup safety is a tangible enrollment argument. In a market where many schools compete on intangible pedagogical differentiators, controlled pickup is something families see, feel, and tell other families about.
A school that can show, on the enrollment visit, that every pickup is recorded with the collector’s photo and that the family receives a notification at release resolves a real anxiety — especially for first-time enrollments.
Enrollment effect: families that perceive concrete safety — not promised, but demonstrable — decide with more conviction and renew with more confidence.
How technology makes the protocol auditable
Technology does not replace the protocol — it makes it robust, scalable, and auditable. Kidsflow was built to turn the legal and operational risk of student pickup into a reliable, documented process.
In practice: each authorized person is registered with a photo by the guardian, temporary QR codes replace WhatsApp-only authorizations, every pickup generates an encrypted auditable record, and data is handled in line with the LGPD. Facing any challenge, the school has documentation; facing families, it has a verifiable process — not just a promise.
Can the school be sued for releasing a child to the wrong person?
Yes. Under Article 932 of the Civil Code and the principles of the ECA, the school is strictly liable for damages from an improper release. Negligence does not need to be proven — it is enough that the damage occurred while the child was in the school’s care. The burden of showing adequate verification processes lies with the institution.
Does a WhatsApp message count as valid pickup authorization?
Not as a formal authorization instrument. A WhatsApp message does not verify the sender’s identity, does not precisely identify the authorized person, lacks the evidentiary weight of a formal record, and can be easily contested. Legally, an authorization must clearly identify who authorizes, who is authorized, and for when — with a traceable record.
What is strict liability and how does it affect schools?
Strict liability is the duty to compensate for damages regardless of proof of fault or intent. It applies to schools under Article 932 of the Civil Code. In practice, if a student is harmed while in the school’s care, the institution can be held liable without the family proving specific negligence. The school’s defense is showing that adequate processes were in place — which is why an auditable record is essential.
How does the LGPD affect student pickup control?
Data collected in pickup control — guardian photos, documents, access records — is personal data under the LGPD. Data of children under 12 has additional protection. Schools need: a legal basis for processing (contract or legitimate interest), secure encrypted storage, access limited to authorized staff, a defined retention policy, and a way for data subjects to exercise their rights. Digital pickup systems should be evaluated for LGPD compliance before adoption.
How can a school show families that pickup is safe?
The most effective demonstration is showing the process in action, not only describing it. Schools using digital pickup control can show, on the enrollment visit: how the authorized registry works, how verification happens at the gate, what record is generated, and how the family receives confirmation. That concreteness turns safety from a promise into a verifiable process.
What is the correct protocol when an unknown person arrives to collect a child?
The standard protocol should be: (1) check whether the person is on the child’s authorized list; (2) if not, do not release the child; (3) contact the legal guardian through a secure channel to confirm and record the authorization; (4) only after documented confirmation, release the child. Never release based only on a verbal claim of kinship without checking the registry.
Is there a certification or standard for school pickup control systems?
In Brazil there is no sector-specific certification for school pickup control systems. Relevant parameters include LGPD compliance, SOC 2 for data security systems, alignment with international standards such as GDPR (used as a reference by many companies), and end-to-end encryption for sensitive data. When evaluating a system, check these criteria specifically and request compliance documentation.
