DPDP Act Compliance for Schools, Colleges and Universities: Children’s Data, Exemptions and a Checklist

Yes, the Digital Personal Data Protection Act, 2023 applies to schools, colleges, universities and coaching institutes for the digital personal data of students, parents, staff and applicants, including paper forms later scanned or typed into a system. Most duties start on 13 May 2027 under the DPDP Rules, 2025. For anyone under 18, the institution needs verifiable consent of a parent or lawful guardian, subject to a narrow exemption in the Rules for tracking and behavioural monitoring for educational activities or children’s safety. Penalties go up to ₹250 crore for failing to keep reasonable security safeguards.

Why an educational institution is a “Data Fiduciary”

Whoever decides why and how personal data is processed is a Data Fiduciary. A college in Kanpur running an admission portal, or a school in Indore keeping marks in an ERP, decides the purpose and the means. The ERP vendor is usually a Data Processor acting on the institution’s behalf, and the institution remains answerable for it.

Almost everything a modern institution holds qualifies: admission forms, hostel lists, fee records, attendance apps, exam results, payroll, recruitment applications and parents’ WhatsApp groups.

Government and aided institutions are covered too, unless a specific exemption applies.

Children’s data: the rule and the exemption, stated accurately

Section 9 sets three duties for children’s data:

1. Verifiable consent of a parent or lawful guardian before processing a child’s personal data (s.9(1)). Rule 10 requires the fiduciary to take appropriate measures to check that the person giving consent is an identifiable adult.
2. No processing likely to cause a detrimental effect on a child’s well-being (s.9(2)).
3. No tracking or behavioural monitoring of children, and no targeted advertising directed at them (s.9(3)).

Rule 12 read with Part A of the Fourth Schedule gives educational institutions a limited carve-out. Sub-sections (1) and (3) of s.9 do not apply where the institution’s processing is restricted to tracking and behavioural monitoring for its educational activities, or in the interests of the safety of children enrolled with it. The Schedule defines an educational institution to include an institution of learning that imparts education, including vocational education.

Read this narrowly. Attendance tracking, learning analytics for teaching and school bus GPS for safety fit the wording. Sharing a class list with a coaching partner for marketing does not. Section 9(2) is not exempted at all, and the rest of the Act (notice, security, breach intimation, erasure) applies in full.

Colleges should remember that many first-year students are 17, so their admission data is a child’s data.

Notices, security and breach reporting

Notice. Where processing is based on consent, give a standalone notice: what data, for what purpose, how to withdraw consent, exercise rights and complain to the Board. Put it on the admission portal, prospectus and recruitment forms.

Security. Rule 6 sets minimum reasonable security safeguards, including encryption, masking or similar measures, access control, logs and monitoring of access, backups for continuity, retention of logs and related personal data for one year unless another law requires otherwise, and security terms in contracts with Data Processors.

Breach. Under Rule 7, on becoming aware of a personal data breach, the institution must inform each affected person without delay, in plain language, with what happened, the likely consequences, what is being done and what they can do. It must also inform the Board without delay, and send a detailed report within 72 hours (or a longer period the Board allows on a written request). Separately, a data leak is already reportable to CERT-In within 6 hours under the CERT-In Directions of 28 April 2022, which apply to government organisations and body corporates.

The 10-point readiness checklist

1. Data map. What data, from whom, why, where stored, who sees it, how long kept.
2. Purpose check. Stop collecting fields you do not need, such as full Aadhaar where a masked number will do.
3. Age gate. Identify which records relate to students under 18 and plan verifiable parental consent for them.
4. Exemption note. Record which tracking you rely on the Rule 12 exemption for, and why.
5. Notices. Plain-language notices for admissions, recruitment, hostel and alumni data.
6. Vendor contracts. Security, confidentiality, breach-notification and deletion clauses for ERP, fee gateway and transport app vendors.
7. Access and sharing. No “anyone with the link” spreadsheets. Role-based access. Remove access when staff leave.
8. Breach procedure. Nodal officer, CERT-In report within 6 hours, Board and affected persons under Rule 7, with templates ready.
9. Rights desk. A published contact for access, correction, erasure and grievances.
10. Training and records. Train office, accounts, IT, wardens and faculty; keep dated attendance records. This is also the due diligence that helps persons in charge under s.85 of the IT Act.

Frequently asked questions

Does the DPDP Act apply to a government school?

Yes, unless a specific exemption applies. The State and its bodies can be Data Fiduciaries under the Act.

Do we need parental consent for every college student?

Only for students under 18. Adult students give their own consent where consent is the basis of processing.

Can a school use GPS tracking on its buses?

Tracking for the safety of enrolled children falls within the Rule 12 exemption. Keep it limited to that purpose.

Is the Act in force today?

The Board provisions are in force. The main duties apply from 13 May 2027. Until then, IT Act s.43A, s.72A and the 2011 SPDI Rules, plus the CERT-In Directions, apply.

Quick quiz

Institution-wide training on these duties: Cyber Crime Law for Offices and Institutions, ₹599. For a deeper DPDP-only course, see the Data Protection Law certificate course (₹599). These are certificates of completion, not professional qualifications.

Sources

• Digital Personal Data Protection Act, 2023: ss.2(f), 5, 6, 8, 9, 33 and Schedule
• Digital Personal Data Protection Rules, 2025: Rules 6, 7, 10, 12 and Fourth Schedule, Part A
• Information Technology Act, 2000: ss.43A, 72A, 85
• CERT-In Directions under s.70B(6), dated 28 April 2022

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.