My sister recently got a job in a private school. Whilst joining it was stipulated that all original certificates be handed over to the institution. 

Is this demand legal? Somewhere else I read that in Gulf and certain countries some employers take control of the passports and they have been challenged by the law authorities. How and where to appeal and report against these folks?

This deposit of certificate is guarantee of being balckmailed and treated like salve.  Anyway it is gainst Bonded labour law. Choice is yours whether to join or not.