DPDP Act Compliance for Schools in India: Complete 2026–27 Implementation Guide

Overview · Applicability

When does DPDP apply to a school?

Covered digital processing for a school will typically include online enquiry, registration and admission forms; Student Information Systems and ERPs; spreadsheets and electronic registers; Google Drive / OneDrive and email attachments; Learning Management Systems; Google Workspace for Education and Microsoft 365 / Teams; online assessment systems; CCTV footage where a person is identifiable; bus GPS, RFID and transport apps; digital attendance, student-ID and biometric systems; parent-communication apps, SMS and school-managed WhatsApp; fee-payment portals; employee, teacher, driver, contractor and applicant records; and website forms, chatbots, analytics and social-media tools.

School categories

↔ Scroll the table horizontally to see all columns.

Sources: DPDP Act, 2023 (India Code) · DPDP Rules, 2025 (MeitY)

Overview · Data map

The school data lifecycle

Personal data enters the school long before a child is enrolled and persists long after they leave. Mapping the whole lifecycle is the fastest way to see where child-data, retention and vendor risks concentrate.

Overview · Roles

Who is the Data Fiduciary?

Correctly identifying the legal entity matters, because that entity must be named in notices, processor contracts, rights workflows, breach notifications and accountability records. The relevant school entity may be a public or private trust, a registered society, a Section 8 company, a private limited company, a government department or State authority, a central education group, or a campus-specific entity within a group.

A Data Processor processes personal data on behalf of a Fiduciary, and may be engaged only under a valid contract. A SaaS product is not automatically a Processor simply because the school pays for it — the role turns on who decides the purpose and means of the relevant processing.

↔ Scroll to see the vendor-role columns.

Source: DPDP Act, 2023, ss.2, 8 (India Code). See also Data Fiduciary and Data Processor.

Children’s data

Why children’s data changes everything

↔ Scroll to see school examples.

Detrimental effect on child well-being (s.9(2))

The Act does not define “detrimental effect on the well-being of a child.” A school should not assume that consent alone permits a processing activity that is otherwise likely to harm child well-being. Higher-risk examples include emotion-recognition tools, persistent behavioural scoring, automated disciplinary profiling, public disclosure of counselling/disability/health information, automated labels such as “high risk” or “disruptive,” and intrusive or disproportionate surveillance. A documented child-well-being review before deploying high-risk monitoring, profiling, biometric or AI tools is a recommended risk-control measure — not a prescribed statutory form for ordinary schools.

Tracking, behavioural monitoring and advertising (s.9(3))

Schools should not assume a system avoids section 9(3) merely because it is labelled “student safety,” “learning analytics” or “engagement monitoring.” Activities needing careful assessment include continuous GPS tracking, facial-recognition access, screen monitoring, browser/device activity tracking, attention/emotion/engagement scoring, AI proctoring, student behavioural profiles, classroom-surveillance analytics, and advertising identifiers or cross-platform tracking.

A child-data decision aid

Children’s data · Consent

Verifiable parental consent (Rule 10)

↔ Scroll to compare verification routes.

OTP is not proof of parenthood. A more defensible model is reliable parent/guardian records established at admission, linked to an authenticated account, with OTP or another second factor and a timestamped record of the specific decision. This is an implementation interpretation of Rule 10, not a prescribed “four-factor” statutory test. For divorced parents, shared custody, guardianship disputes, boarding students and children in care, the Act sets no complete protocol — record custody/guardianship orders where supplied, distinguish parent, guardian, emergency contact and fee payer, grant portal access only to those with documented authority, and escalate disputes rather than letting staff decide them.

Source: DPDP Rules, 2025, Rule 10 (MeitY) · Section 9

Children’s data · Exceptions

Rule 12 and the Fourth Schedule: what is (and isn’t) exempt

Educational institution (Part A item 3)

Educational activities

Safety of enrolled children

School transport (Part A item 5) & real-time safety (Part B item 4)

School email accounts (Part B item 3)

Sources: DPDP Act, 2023, s.9 · DPDP Rules, 2025, Rule 12 & Fourth Schedule

School operations

DPDP Act compliance in admissions

↔ Scroll to see the DPDP concern and recommended action.

Recommended admission controls: separate mandatory eligibility fields from optional scholarship/transport/publicity fields; do not treat a broad admission signature as universal permission for social media, EdTech, biometrics, AI or marketing; build a parent/guardian authentication workflow before enabling child digital accounts where s.9(1) applies; restrict document access; do not make Aadhaar the only identity route; define retention for incomplete and unsuccessful applications; and keep a data inventory showing which vendor receives each admissions-data category.

School operations · Consent

School consent architecture

Different activities carry different consent and child-data implications. Do not bundle a publicity or optional-service permission into a core admission or academic workflow — separate the optional from the essential, and record what withdrawal means for each.

↔ Scroll to see grounds, withdrawal and classification.

School operations · Transparency

School privacy notices

Section 5 requires a consent request to be accompanied or preceded by notice identifying the personal data and purpose, how to exercise rights, and how to complain to the Board. Rule 3 requires clear, plain-language, itemised notice with links for withdrawal, rights and Board complaint. Section 5(3) gives the Data Principal the option to access notice contents in English or any Eighth Schedule language; section 6(3) does the same for a consent request. The Act does not require every school to publish every notice in all 22 languages.

Recommended layered-notice structure

Sources: Section 5 (notice) · Section 6 (consent) · DPDP Rules, 2025, Rule 3 · Notice

School operations · Rights

Student and parent rights

The Act provides rights of access, correction/completion/updating, erasure, grievance redressal and nomination. Rule 14 requires a school to prominently publish how to make rights requests and a reasonable grievance-redressal period that does not exceed 90 days.

School operations · Staff

Employee and teacher data

Analyse employee data separately from student child data. Section 7(i) permits processing for employment purposes and for safeguarding the employer from loss or liability in specified contexts — but it is not a blanket basis for unlimited surveillance, unrelated marketing or disclosure unrelated to employment.

Source: Section 7 (certain legitimate uses)

School operations · Web

School website compliance

Be cautious about advertising pixels and behavioural advertising on child-facing or admissions pages. The restriction on targeted advertising directed at children should not be assumed displaced by the educational-institution exception.

Technology

What applies to a specific school technology?

Each technology raises a slightly different combination of issues. Pick a system to see the main DPDP issue, the relevant law, whether Rule 12 is even in play, the common mistake, and a sensible first action. (Every panel is also printed in full below.)

Can schools use CCTV?

↔ Scroll to see risk and recommended control.

Adopt a documented, proportionate retention approach linked to safety, incident investigation, claims and legal-hold requirements. Signage, role-based access, export restrictions, audit logs and limited viewing are advisable privacy and security controls — not all expressed as school-specific DPDP commands.

School bus GPS and student tracking

Fourth Schedule Part A item 5 addresses a transport provider engaged by the institution, allowing tracking of enrolled children’s location for safety during travel to or from school. Part B item 4 separately addresses real-time location for a child’s safety, protection or security, limited to that purpose. The exception is purpose-limited — “student safety” is not a generic licence for continuous surveillance.

Biometrics and facial recognition

Providing a manual, RFID-card or supervised attendance alternative is a prudent proportionality control where practical. DPDP does not expressly impose a universal alternative-method requirement.

EdTech and vendor compliance

Vendor assessment questions

↔ Scroll to see DPDP basis and evidence to obtain.

Foreign cloud platforms

As of the research cut-off, no school-specific transfer restriction, foreign-country block list or universal education-data localisation requirement was identified in the reviewed primary material. Recheck before procurement and periodically. No vendor should be certified generically as “DPDP compliant” — the analysis depends on your actual configuration, enabled functions, child accounts, analytics/advertising settings, AI-training terms, retention, export ability, contractual role and hosting/support locations. s.16

WhatsApp and school communications

Prefer parent apps, SMS, email, secure portals or broadcast tools where parents need not see each other’s numbers; maintain a staff messaging policy; provide an alternative channel for parents who do not use WhatsApp; and train staff not to treat a WhatsApp “yes” as a substitute for verifiable parental consent.

AI use in schools

Higher-risk uses include generative AI tools (ChatGPT, Gemini, Copilot), AI tutoring, automated grading, essay assessment, AI proctoring, student-risk scoring, behavioural analytics, facial/emotion/attention recognition, AI-generated disciplinary flags, and tools that use uploaded student work for model training.

AI decision logic — can this student information go into this AI system?

Regulatory

Aadhaar and APAAR

Distinguish the Aadhaar number, an Aadhaar photocopy, Aadhaar authentication, voluntary Aadhaar use, alternative identity/age documents, and a separate board/exam/welfare/government-scheme requirement. A government scholarship or welfare scheme may create its own identification obligations under its own framework — verify the precise scheme, authority, data fields, alternatives and legal source rather than generalising.

APAAR, CBSE registration/LOC and DigiLocker

APAAR is a distinct government education identity workflow: the official APAAR process describes parents submitting consent voluntarily for APAAR ID creation, and identifies parental consent as a step for minors. It should not be treated as proof that Aadhaar is mandatory for ordinary admission. CBSE’s 2025 materials addressed linking APAAR ID to registration/LOC data; the 11 September 2025 partial-relaxation material stated that where APAAR ID was not generated because parents did not consent, schools should record the denial and enter “REFUSED” in the LOC, and enter “NOGEN” where non-generation occurred for other reasons.

Sources: Supreme Court, Aadhaar judgment (2018) · APAAR portal · CBSE examination circulars

Regulatory · Retention

Data retention and deletion

↔ Scroll to see other retention sources and approach.

CISCE regulations provide a verified example of board-specific rules: CISCE does not retain answer scripts later than 60 days after declaration of results, and schools retain assessed ICSE/ISC assignments for 60 days after result declaration. Separately, Rule 8(3) requires retention of personal data, associated traffic data and processing logs for at least one year for the Seventh Schedule purposes, subject to longer applicable-law retention — assess its scope carefully for each school system.

Sources: Section 8(7) · CISCE Regulations · DPDP Rules, 2025, Rule 8(3)

Regulatory · Incidents

Data breaches

Ransomware, an unavailable ERP, a lost laptop, an exposed Drive link, wrongly shared report cards, leaked CCTV or transport-location exposure can all require breach assessment.

Regulatory · Security

Reasonable security safeguards

Section 8(5) requires reasonable security safeguards. Rule 6 specifies appropriate technical and organisational measures — including encryption/obfuscation/masking or virtual tokens; access controls; visibility through logs/monitoring/review; continuity measures including backups; one-year log retention; processor-contract security provisions; and measures to ensure effective observance. DPDP does not expressly require every school to use MFA, hold ISO 27001, encrypt every field or run annual penetration tests — those are risk-based choices; the statutory standard is reasonable safeguards and appropriate Rule 6 measures.

Sources: Section 8(5) · DPDP Rules, 2025, Rule 6

Regulatory · Public sector

Government schools

Government schools are not automatically exempt merely because they are government-run. They may process data as State instrumentalities, and sections 7 and 17 can affect particular activities. Section 17 contains specific exemptions/modifications — for example, s.17(4) modifies s.8(7) and s.12(3) for processing by the State or its instrumentalities, and modifies s.12(2) where the purpose does not include a decision affecting the Data Principal. It does not create a universal government-school exemption. Government-school systems should identify the relevant public authority, map each statutory function, verify any s.7 ground, and determine whether a specific s.17 exemption or actual notification applies. s.17

Regulatory · Governance

Does every school need a DPO?

If notified as an SDF, an organisation must appoint an India-based DPO and an independent data auditor, and conduct periodic DPIAs and audits; Rule 13 requires a DPIA and audit once every 12-month period from notification. Ordinary schools should still publish the business contact details of a DPO where applicable — or another person able to answer processing queries — and maintain an effective grievance mechanism.

Regulatory · Penalties

Penalties

These are maximum statutory ceilings, not automatic fines. Under section 33, the Board must consider the nature, gravity and duration of non-compliance; the data affected; repetitive nature; gain/loss avoided; mitigation; proportionality; and the likely impact of the penalty.

↔ Scroll to see Schedule item and school example.

Source: DPDP Act, 2023, s.33 & the Schedule (India Code)

Implementation

The 15 highest-priority risks

If time is short, these are the exposures that most often turn into incidents, complaints or penalty-relevant failures. Severity reflects likely impact and sensitivity, not a statutory grade.

School DPDP readiness check

Answer 13 quick questions for an indicative readiness band across the areas that matter most before 13 May 2027. Everything runs in your browser — nothing is sent anywhere.

Implementation roadmap to 13 May 2027

A workable sequence for the window before the core provisions commence. Adjust to your entity structure, board obligations and technology stack.

School DPDP readiness checklist

A grouped checklist you can work through with IT, admissions, academics, HR, finance, transport and communications.

Myth vs fact

Management FAQ

Primary sources

Law-level statements in this guide are anchored to primary material. Always confirm against the latest official version.

Related DPDP Act resources

Written by

The DPDPActIndia editorial team.

Last updated

3 September 2026.

Editorial methodology

This guide separates what the Act text states, what the notified 2025 Rules add, what depends on future notifications or verification, and what is an implementation interpretation. Statements are labelled as Law, Interpretation, Practice or Verify where that distinction matters, and law-level claims are anchored to the primary sources listed above.

Scope note

Focused on ordinary Indian schools processing covered digital personal data. Significant Data Fiduciary duties are noted only where relevant.

This guide is general information about the DPDP Act, 2023 and the DPDP Rules, 2025 for Indian schools. It is not legal advice, an audit or a certification, and it has not been individually reviewed against any specific school’s facts. Confirm your position against the current official Act, Rules, board/state requirements and, where needed, qualified legal advice before acting.