DPDP and Your Institution: What the Law Asks, and What You Still Have Time to Fix

A plain-English guide for correspondents, principals, trustees and administrators.

In November 2025 the Government of India notified the Digital Personal Data Protection Rules. Most of the obligations they create begin on 14 May 2027. If your institution holds the name, photograph, phone number, address, marks or fee record of even one student — and every institution does — this law applies to you.

Most of the schools and colleges we speak to have not read it. That is not carelessness. The law arrived quietly, it is written in the language of companies rather than campuses, and no department circular has landed on anyone's desk about it. But it is a law, the penalties attached to it are large, and the seven months between now and May 2027 is not a long time to change the way an office works.

What follows is an explanation of what the law asks of an educational institution, written for the people who run one.

What has actually happened

The Digital Personal Data Protection Act was passed in August 2023, but it sat largely dormant because the rules that make a law operational had not been written. Those rules — the Digital Personal Data Protection Rules, 2025 — were notified in the Gazette on 13 November 2025 as G.S.R. 846(E).

The rules do not all commence at once. The Government chose a phased schedule, which is why nothing appeared to happen in your office in November 2025 and why many institutions concluded, reasonably, that this was somebody else's problem.

The three dates that matter

13 November 2025 — already in force

The Data Protection Board of India was constituted and the machinery around it switched on. Nothing was asked of institutions on this date.

14 November 2026 — six weeks away

Registration of Consent Managers opens. This matters mainly to the platforms that will offer consent management as a service. It does not place a direct obligation on your institution, but it is the signal that enforcement machinery is assembling.

14 May 2027 — your date

The substantive rules commence. Consent notices, security safeguards, breach reporting, retention limits, the special protections for children's data, and the rights parents can exercise against you all begin on this day.

One caution on the dates

The Ministry of Electronics and Information Technology has floated a proposal to bring the substantive rules forward. It has not been notified, so 14 May 2027 remains the operative date. Plan on the basis that the date could move earlier rather than later.

Your institution is a "Data Fiduciary"

The law uses three terms, and it is worth learning them because every obligation hangs off them.

• Data Principal — the person the data belongs to. In your case the student, and the parent or guardian.
• Data Fiduciary — whoever decides why and how that data is collected and used. That is your institution.
• Data Processor — whoever handles the data on your instructions. Your ERP vendor, your biometric attendance supplier, your bus tracking app, your SMS gateway.

The important consequence is the one institutions most often get wrong: the responsibility sits with the fiduciary. You cannot transfer it to a vendor by signing a contract. If a vendor loses your students' data, the law looks at you first and asks what you did to prevent it.

This applies to private and government institutions alike, and to schools, PU and junior colleges, degree colleges, professional institutions and coaching centres. Size is no exemption.

Why education is the hardest case in this law

Under the Act a child is anyone under eighteen. For a school, that is the entire student body. Section 9 therefore lands on education harder than on almost any other sector, because it adds two requirements on top of everything else.

First, verifiable consent of a parent or guardian before a child's personal data is processed. Second, a prohibition on tracking, behavioural monitoring and targeted advertising directed at children.

There is a practical problem buried in that definition. A degree or professional college has a mixed population — some students under eighteen, some over. The law treats the two groups differently, which means your records have to be able to tell them apart and your processes have to behave differently for each. Most institutions cannot do that today, because date of birth sits in an admission file and nothing in the office keys off it.

What "verifiable parental consent" actually requires

This is the part that surprises people, and the part worth reading twice.

The rules require the institution to take reasonable steps to check that the person giving consent really is the child's parent or guardian, and really is an identifiable adult. Three routes are contemplated: identity and age details the institution already holds reliably; details the parent provides, which the institution then checks against a reliable source; or a virtual token issued by an authorised entity, such as through DigiLocker.

What does not meet that standard is the ordinary practice of almost every campus in the country:

• A tick box at the bottom of the admission form.
• An "I agree" button on an app screen.
• A signature on a form that never said what the data would be used for.
• A WhatsApp message from a number you believe belongs to the father, saying "ok sir".

Consent also has to be specific to a purpose. One signature at admission does not cover photographs on the institution's Instagram page, a tie-up with a third-party learning app, or an SMS campaign to last year's enquiries. Each purpose needs its own consent, and the parent must be able to withdraw it as easily as they gave it.

The education exemption — read it carefully

There is relief in the rules for educational institutions, and it is important to know both what it covers and what it does not, because it is being over-read in a lot of what is currently circulating.

The Fourth Schedule exempts an educational institution from the section 9 restrictions where the processing is restricted to tracking and behavioural monitoring for the educational activities of the institution, or in the interests of the safety of children enrolled with it. A transport provider working for an institution has a parallel exemption for tracking a child's location while travelling to and from the campus. Clinical establishments and crèches have their own entries.

So attendance, academic monitoring and a school bus tracking app used for child safety sit inside that carve-out. That is genuine and useful relief, and it means the law is not asking you to stop running your school.

What the exemption does not do

It does not exempt your institution from the rest of the Act. Notice, security safeguards, breach reporting, retention limits, grievance handling and the general consent framework all still apply. And the exemption is bound to its purpose — the moment the same data is used for something else, such as a marketing push, a commercial app bundled alongside your system, or sharing with a coaching tie-up, the exemption stops covering it.

The six things the law will ask of you

1. A notice, in plain language. What you collect, why, who you share it with, how long you keep it, and how a parent raises a complaint. It has to be understandable by the parent who reads it, which for most institutions means it exists in the regional language as well as English.
2. A record of consent. Not a signed form in a cupboard, but a record you can produce: who consented, to what purpose, when, and against which version of the notice.
3. Retention with an end date. You must decide how long you keep each kind of record, write it down, and then actually delete it. Almost every institution we have seen holds every record it has ever created, forever, including for students who left fifteen years ago.
4. Reasonable security safeguards. Access control, encryption, logs, backups, and a sensible answer to the question "who can see this?" The obligation is yours even when the server is your vendor's.
5. Breach reporting. If student or parent data is exposed, you intimate the Data Protection Board without delay and file a fuller report within seventy-two hours, and you tell the affected parents in plain language what happened, which data was involved, what might follow, what they should do, and who to contact. There is no minimum threshold — "it was only a list of phone numbers" is still a breach.
6. A published point of contact. A named, reachable person who answers data questions, and a route for a parent to complain before they go to the Board.

Where institutions are exposed today

This is the part worth taking to your next management meeting. None of the following is unusual, and all of it is a problem under the new framework.

The parent WhatsApp group

Almost every institution runs parent communication through WhatsApp groups in which every parent's mobile number is visible to every other parent, and to anyone later added or forwarded in. That is a disclosure of personal data to third parties, at scale, with no consent and no record. It is the single most common exposure in Indian education, and it is also the easiest to fix.

Student data on personal devices

Marks sheets, fee registers and contact lists in Excel on a teacher's own laptop, moved around on pen drives and personal email. Staff move on; the files do not. You cannot report a breach you cannot detect, and you cannot detect a breach in a file you do not know exists.

One shared office login

Where the whole office works under a single account, nobody can say who viewed or changed a record. That fails the security expectation, and it also makes the breach investigation the law requires of you impossible to carry out.

Biometric and face-recognition attendance

Installed widely, usually without anyone asking whether it is necessary, how long the templates are kept, where they are stored, or what happens if the supplier is compromised. Biometric data cannot be reissued like a password. If you use it, be able to justify why a less intrusive method would not do.

Photographs of children

Event photographs and videos posted on the institution's social media under the authority of a general line in the admission form. That is exactly the kind of purpose that now needs its own consent, and that a parent can withdraw.

Vendor apps nobody has a contract with

A free app the staff started using, a fee gateway onboarded over a phone call, a learning platform added mid-year. If there is no written agreement saying what the vendor may do with the data and where it is stored, you are carrying that risk yourself.

Enquiry data reused years later

Admission enquiry lists from three years ago still being messaged about this year's intake. The parent consented to a conversation about one admission, not to a marketing list.

None of these require a lawyer to fix. Most require a decision and an afternoon.

What to do in the next seven months

A workable sequence, roughly a month at a time, that a school office can actually follow alongside its normal work.

1. Find out what you hold. Every register, every Excel file, every app, every device — biometric readers, CCTV, bus trackers, the SMS gateway, the website enquiry form. Write it in one list with where it lives and who can see it. This step is dull and it is the one everything else depends on.
2. Name one person. Not a committee. One person who owns this, with the authority to tell a department to stop doing something.
3. Rewrite the notice and the admission consent. Purpose by purpose, in plain language, in the languages your parents read. Do this before the next admission season so the new cohort is captured correctly from day one.
4. Fix access. One login per person, access set by role, former staff removed the week they leave. Check what a clerk can currently open.
5. Decide retention, and start deleting. Pick a period for each record type, document the reasoning, and clear out what is past it. Deleting data you have no reason to hold is the cheapest risk reduction available to you.
6. Get your vendors in writing, and rehearse a breach. A data processing agreement with everyone who touches student data, and a one-page drill: who is called in the first hour, who writes to the Board, who talks to parents.
7. Do a dry run. Have a parent — or a trustee playing one — ask for everything you hold on their child, and see how long it takes you to answer. That single exercise will tell you more about your readiness than any checklist.

What software can do, and what it cannot

We build school and college software, so we will be direct about this: no system can make your institution compliant. Compliance is a set of decisions and habits, and most of the gaps described above are matters of process rather than product. Any vendor who tells you their software makes you DPDP compliant is selling you a feeling.

What a well-run system does do is make those decisions enforceable and provable. Access becomes a setting rather than an instruction nobody follows. Who opened a record becomes a log rather than an argument. Retention becomes a rule rather than an intention. A parent's request becomes a report rather than three days of searching. The institution still has to decide; the system is what stops the decision quietly eroding.

Seven questions to ask your current vendor, in writing

1. Does every user have an individual login, and can we set what they see by role?
2. Is there an activity log that shows who viewed or changed a record, and can we export it?
3. Where is our data stored, in which country, and which of your staff can access it?
4. Can we set retention periods, and does the system delete data when they expire?
5. What happens to our data if we stop being your customer — do we get it, and do you delete your copy?
6. Will you sign a data processing agreement?
7. If you are breached, how and within what time will you tell us?

Ask for the answers by email rather than in a meeting. A vendor who cannot answer these in writing has given you the answer.

Penalties, briefly

The Act provides for penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹200 crore for failing the obligations that attach to children's data. In deciding what to impose, the Board is directed to consider the nature and gravity of the breach, how long it went on, whether children were affected, and what the institution did to mitigate it.

Realistically, a single school is not going to be fined ₹250 crore. But two things follow from the way the law is drafted. The Board is told to look hardest where children are involved, and in education nearly all of the data is children's data. And the sanction most institutions should actually worry about is not the fine — it is the first parent who writes to the Board about how their child's information was handled, and the conversation that starts with your management committee the following week.

The short version

Nobody expects a school to run a data protection department. The institutions that come through this comfortably will be the ones that started with the ordinary things: one login per person, a notice a parent can understand, a retention rule somebody wrote down, a named person who answers questions, and a written answer from every vendor who touches student data.

Seven months is enough time to do all of that. Seven weeks will not be.

Sources

• Digital Personal Data Protection Rules, 2025 — G.S.R. 846(E), notified 13 November 2025, Ministry of Electronics and Information Technology.
• Digital Personal Data Protection Act, 2023 — section 9 (children's data) and the Schedule of penalties.
• Digital Personal Data Protection Rules, 2025 — Rule 10 (verifiable consent of parent or guardian) and the Fourth Schedule (exemptions from section 9(1) and 9(3)).

This article is general information for institutional management and is not legal advice. The DPDP Act and the Rules made under it are subject to amendment and to clarification by the Data Protection Board of India. Institutions should take advice from a qualified professional on their own circumstances before acting on anything described here. Dates and provisions stated are as at October 2026.

MyEduate is a school and college management platform used by over 500 institutions. If you would like to see how individual logins, role-based access, activity history and retention settings work in practice, book a demonstration.

+91 98447 74400 (India) · +1 407 967 5999 (USA)