Schools hold more personal data than almost any other organisation of their size: names, addresses, phone numbers, health notes, photographs, marks, fee records and, increasingly, bus locations and attendance data. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) sets the rules for how that data must be collected, used, protected and deleted, and the DPDP Rules notified in November 2025 set out when each duty applies.
This guide explains what the DPDP Act means for schools, the key dates, the special rules for children's data, and a practical checklist. It is general information, not legal advice; take advice from a lawyer for your school's specific situation.
Key dates under the DPDP Rules, 2025
The Rules were notified on 13 November 2025 and phase in over 18 months:
- November 2025: provisions setting up the Data Protection Board came into force.
- 13 November 2026: rules for consent managers apply.
- 13 May 2027: the main duties apply, including notice and consent, security safeguards, breach reporting, children's data and the rights of individuals.
That gives schools until May 2027 to get ready, which is less time than it sounds once vendors, contracts and staff training are involved.
Who is who under the DPDP Act
- Data Principal: the person the data is about. For a student under 18, the parent or lawful guardian acts on the child's behalf.
- Data Fiduciary: the organisation that decides why and how data is processed. Your school is the data fiduciary for student, parent and staff data.
- Data Processor: a vendor that processes data on the school's behalf, such as your ERP, payment gateway or messaging provider. The school remains responsible for what its processors do.
What the DPDP Act means for schools
Notice and consent
Where the school relies on consent, it must give a clear notice listing the personal data collected and the purpose, how to withdraw consent, and how to complain. The notice must be in clear language, available in English or any language in the Eighth Schedule of the Constitution.
Children's data
The Act treats anyone under 18 as a child. Data fiduciaries must obtain verifiable consent from a parent before processing a child's personal data, and must not track, behaviourally monitor or target advertising at children.
The Rules give educational institutions a narrow exemption: for processing done for educational activities and for the safety of children, these parental-consent and tracking restrictions do not apply in the same way. The exemption is tied to those purposes, so data used for anything else, such as marketing, still needs proper consent.
Security safeguards
Schools must take reasonable security measures, such as encryption or masking, access controls, logs of who accessed data, and backups. Penalties for failing to protect data can reach up to ₹250 crore under the Act.
Breach reporting
If personal data is breached, the school must inform the Data Protection Board and the affected individuals without delay, and send the Board a detailed report within 72 hours.
Rights of parents, students and staff
Individuals can ask what data the school holds, ask for corrections or erasure, and raise grievances. The school must publish how to contact it and respond within set timelines.
Retention and deletion
Personal data should be kept only as long as it is needed for its purpose, then erased, unless a law requires the school to keep it. Admission enquiries that never converted are a common example of data kept for too long.
Why fewer vendors means less risk
Most schools spread student and parent data across an ERP, an admissions CRM, a fee gateway, a bus tracking vendor, a biometric device supplier, a messaging reseller and several spreadsheets. Under the DPDP Act, the school is answerable for all of them. Every extra vendor is another contract to review, another place a breach can happen, and another system to search when a parent asks what you hold. We cover this in School ERP vs 7 separate apps.
A DPDP checklist for schools
- Map your data. List what personal data you collect about students, parents and staff, where it is stored and who can see it.
- List your vendors. Every app, gateway and service that touches personal data.
- Review contracts. Make sure each processor commits to security, breach reporting and deletion.
- Update notices and forms. Admission forms, enquiry forms and the website should say what is collected and why.
- Separate purposes. Keep educational and safety uses apart from marketing, which needs consent.
- Limit access. Staff should see only what their role needs.
- Plan for breaches. Decide who does what, and how you will meet the 72-hour report.
- Set retention periods. Decide how long each kind of record is kept, and delete what is no longer needed.
- Name a contact. Publish who parents and staff can contact about their data.
- Train staff. Office staff, teachers and counsellors handle personal data every day.
Questions to ask your software vendors
- Where is our data stored, and who in your company can access it?
- What security certifications do you hold?
- How quickly will you tell us about a breach?
- Will you delete our data if we leave, and confirm it in writing?
- Which other companies process our data on your behalf?
How CtrlCampus helps
CtrlCampus is ISO 27001 certified, commits to a 99.9% uptime SLA, and is aligning with the DPDP Act, 2023. If a school leaves, we delete its data and confirm it in writing. Because one platform replaces several apps, fewer companies hold your students' data, and messages go from your school's own verified number through official WhatsApp rather than a reseller. Read more on our security and trust page.
Data-heavy features deserve extra care. Our guides to face recognition attendance and school bus tracking cover the privacy questions for each, and the Oaktree Kidz case study shows a school group running on one platform.
FAQ: DPDP Act for schools
When does the DPDP Act apply to schools?
The Rules were notified in November 2025. Most duties, including consent, security, breach reporting and children's data, apply from 13 May 2027.
Do schools need parental consent for every use of student data?
Educational institutions have an exemption from the verifiable parental consent and tracking rules for educational activities and children's safety. Other uses, such as marketing, still need consent.
Who is responsible if our software vendor has a breach?
The school, as data fiduciary, remains responsible, which is why vendor contracts and fewer vendors matter.
What are the penalties under the DPDP Act?
Penalties are set per breach of duty, and can reach up to ₹250 crore for failing to take reasonable security safeguards.
Does the Act cover staff data too?
Yes. Staff records, payroll data and attendance are personal data and need the same care. Book a demo to see how CtrlCampus keeps everything in one secure platform.
