The DPDP Act and Schools: What India’s Data Protection Law Means for Student Data

Schools hold more personal data about children than almost any other organisation: names, dates of birth, addresses, photographs, health notes, marks, attendance, fee payments and family details. India’s Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how that data is collected, used and protected.

This article is a general overview for school leaders, not legal advice. The Act and its Rules are detailed and will be interpreted over time; consult a lawyer for your school’s specific situation.

The basics

• The DPDP Act was passed in August 2023. The DPDP Rules that put it into practice were notified in November 2025, with most obligations phasing in over the following 18 months.
• A school that decides why and how personal data is processed is a data fiduciary. A software vendor that processes data on the school’s behalf is a data processor.
• Under the Act, anyone under 18 is a child.
• Penalties for serious failures — such as not taking reasonable security safeguards — can be very large.

What changes for schools

Verifiable parental consent

Processing a child’s personal data generally requires verifiable consent from a parent or lawful guardian. In practice, schools should review their admission forms and consent process: what data is collected, for what purposes, and how the parent agreed to it. The Rules provide some exemptions for educational institutions — for example, for processing that is needed for educational activities and for children’s safety — so check how these apply to your school.

Collect only what you need, for a stated purpose

Data should be collected for a clear, lawful purpose and used only for that. A school does not need a parent’s annual income for attendance, or a child’s photograph in the transport register. Review your forms and remove fields you cannot justify.

No tracking or targeted advertising aimed at children

The Act prohibits tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions. Be careful with third-party apps and websites that students are asked to use.

Reasonable security safeguards

Schools must protect the data they hold. That includes access controls (not every staff member needs to see everything), secure passwords, encrypted storage and transfer, and care with spreadsheets sent by email or shared on messaging apps.

Breach notification

If personal data is breached, the school must inform the Data Protection Board and the affected individuals. Know who in your school is responsible for this before you need them.

Erasure when the purpose is over

Personal data should not be kept forever “just in case”. Decide how long you keep records of students who have left, subject to any legal requirement to retain them.

Questions to ask your school software vendor

Your vendors process children’s data on your behalf, so their practices become your responsibility. Ask:

1. Where is our data stored? In India? On which cloud?
2. Is our data separated from other schools’ data?
3. Can access be restricted by role — so a teacher sees only their own classes?
4. Is there an audit log of who changed what?
5. Is data encrypted in transit and at rest?
6. How would you tell us about a breach, and how quickly?
7. Can we export and delete our data when we leave?

How SchoolKonnect approaches this

SchoolKonnect hosts school data on Microsoft Azure in India, keeps each school’s data in its own database, encrypts connections with HTTPS, and lets the school decide exactly what each role can see. Changes are recorded in an audit log. More detail is on our security page.

A starting checklist

• Map the personal data you collect, where it is stored and who can see it.
• Review admission and consent forms.
• Remove fields you do not need.
• Restrict staff access by role.
• Stop sharing student lists on personal messaging groups.
• Name a person responsible for data protection and breach response.
• Review your vendors’ contracts and security.

Data protection is now part of running a school well. Talk to us if you would like to see how SchoolKonnect handles student data.