The Digital Personal Data Protection (DPDP) Act, 2023 is India's law on how organisations collect, use, store and delete people's personal data. A school that keeps student, parent or staff records on a computer or in an app is covered, and because almost every student is under 18, schools fall under the Act's strictest rules: those for children's data.
This article is general information, not legal advice. Check the official text and talk to a lawyer about your school's situation.
When does it apply?
The DPDP Rules, 2025 were notified on 13 November 2025 and phase in over 18 months. Most of the obligations on organisations apply from 13 May 2027. That is the date to plan for, unless the government notifies a change.
Key terms in plain words
- Data Principal: the person the data is about. For a student under 18, the parent or guardian acts for them.
- Data Fiduciary: the organisation that decides why and how data is used. That is the school.
- Data Processor: a company that handles data on the school's behalf, such as the ERP or app provider.
Children's data: the stricter rules
Under the Act a child is anyone under 18. Before processing a child's personal data, the school needs verifiable consent from a parent or lawful guardian. The Act also bars tracking, behavioural monitoring of children and targeted advertising aimed at them.
The Rules give educational institutions a limited exemption from the consent and monitoring rules, but only for processing that serves the school's educational activities or the safety of its enrolled children. It is not a blanket exemption: the rest of the Act (security, breach reporting, data rights) still applies, and anything outside education and safety, such as marketing, needs consent.
What a school must do
- Give clear notice. Tell parents in simple language what data you collect, why, and how they can raise a concern.
- Collect only what you need. If a field has no educational or safety purpose, stop collecting it.
- Keep data secure. Use role-based access, strong passwords, encrypted connections and tested backups.
- Report breaches. A personal data breach must be reported to the Data Protection Board and to the people affected.
- Honour data rights. Parents can ask to see, correct or erase data, and to name someone to act for them.
- Delete when done. Do not keep personal data longer than its purpose needs.
- Bind your vendors. Your ERP and app providers process data for you; your contract should cover security and deletion.
What is at stake
The Act's schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore each for failing to report a breach or to meet the obligations for children's data. Beyond fines, a leak of children's data costs a school the trust of its parents.
A starter checklist for your school
- List every place student data lives: ERP, spreadsheets, WhatsApp groups, paper files.
- Remove data you do not need, and old records past their purpose.
- Give each staff role only the access it needs.
- Write a short privacy notice for parents and add consent to your admission form.
- Agree who handles a data request or a breach, and how fast.
- Ask your ERP vendor how they support each point above.
How Eduzon helps
Eduzon keeps each school's records separate, controls access with roles and permissions, works over encrypted HTTPS connections and supports per-school backups. Optional modules that involve sensitive data, such as CCTV live view for parents, are off by default and record parental consent when a school turns them on.
Frequently asked questions
Does the DPDP Act apply to schools?
Yes. Any school that keeps personal data of students, parents or staff in digital form is a Data Fiduciary under the Act, and most students are children under 18, so the stricter rules for children's data apply.
Do schools need parental consent to keep student records?
The Act requires verifiable parental consent to process a child's data, but the Rules give educational institutions a limited exemption for processing that serves their educational activities and the safety of enrolled children. Uses outside those purposes still need consent.
When do schools have to comply?
The DPDP Rules, 2025 were notified on 13 November 2025 and phase in over 18 months, so most obligations apply from 13 May 2027.
Sources
- Data protection framework, Ministry of Electronics and Information Technology
- DPDP Act, 2023 and DPDP Rules, 2025, EY India
