Student data protection and DPDP: a guide for Indian schools

What student information do schools hold?

A school record is much broader than a name and marksheet. It can include contact details, date of birth, photographs, identifiers, attendance, transport, health or accessibility information, fee transactions, behaviour records, teacher observations, parent communications, device information and data created by learning platforms.

Begin with a data map: what is collected, from whom, for what purpose, in which system, who can access it, which vendors receive it, how long it is retained and how it is deleted. Schools cannot govern information they have not identified.

• Identity and admission records
• Parent, guardian and emergency contacts
• Attendance, academic and assessment records
• Fees, concessions and transaction information
• Health, accessibility, safeguarding and well-being records
• Transport routes, location or driver-app data
• Communications, photographs and activity records
• System logs, credentials and device metadata

What does DPDP mean for schools?

India's Digital Personal Data Protection Act, 2023 governs processing of digital personal data. The Digital Personal Data Protection Rules, 2025 were notified with a phased commencement: some provisions took effect on notification, while others begin later under the published timeline. Schools should verify which provisions are in force when implementing a compliance plan.

In plain language, governance should ensure that personal data is processed for a lawful, defined purpose; people receive clear information; only necessary data is used; reasonable security safeguards exist; rights and grievances can be handled; and information is erased when the purpose and legal retention need no longer apply. The Act and Rules use precise legal definitions and exceptions, so a school should not treat a checklist as a substitute for legal review.

Start with purpose

For every field, be able to answer: Why does the school need this? Who uses it? How long is it needed? What happens when the purpose ends?

Children, parents and verifiable consent

The DPDP framework gives special treatment to children's personal data. The Act addresses verifiable parental consent and restricts processing that is likely to cause detrimental effects, as well as tracking, behavioural monitoring and targeted advertising directed at children, subject to the Act and notified exemptions.

The 2025 Rules set out methods for verifiable consent and specify limited exemptions for certain classes and purposes, including educational institutions in defined circumstances. Those exemptions are not a blanket permission to collect or reuse any child data. A school should identify the exact purpose, applicable provision and safeguard before relying on one.

• Use clear, purpose-specific notices in accessible language.
• Verify the role of the parent or lawful guardian where required.
• Keep a record of the notice, consent or other lawful basis relied upon.
• Avoid reusing educational data for unrelated promotion or profiling.
• Provide a route for questions, correction and grievance handling.

Who should access what?

Access should follow role and educational need. A subject teacher may need academic and attendance context but not detailed fee transactions. A finance user may need billing records but not counselling notes. Senior administrators may require summaries without unrestricted access to every sensitive field.

Use least privilege, named accounts, strong authentication and a regular access review. Remove or change access promptly when responsibilities change. Shared passwords and broad administrator accounts make accountability difficult even when the underlying system is encrypted.

What schools should ask an ERP vendor

Security claims should be specific enough to verify. Ask where data is hosted, how it is encrypted, how backups work, who can access production data, how incidents are handled and how the school receives a complete export at exit.

The contract should describe purpose, confidentiality, subcontractors, support access, retention, deletion, breach coordination and the return of data. Unverified marketing claims of blanket compliance do not replace documented controls and responsibilities.

• What student and guardian fields are collected by default?
• Can each role be restricted to the minimum records it needs?
• Are data encrypted in transit and at rest?
• Which actions appear in an audit trail, and how long is it kept?
• Which subprocessors or integrations receive personal data?
• What is the incident-notification and response process?
• How can the school export, correct and delete records?
• What proof confirms deletion after contract termination?

Data migration, retention and deletion

Migration creates extra copies: spreadsheets, exports, test imports, error files and backups. Assign an owner, use an approved transfer channel, restrict access, validate the import and delete temporary copies on a defined schedule. Never leave full student exports in personal email, messaging apps or unmanaged drives.

Retention should reflect educational, operational and legal needs. Define schedules by record type rather than keeping everything indefinitely. At exit, the school needs a usable export, a verification period and a documented deletion process covering live systems and backups subject to the agreed retention design.

Handle identifiers and sensitive context carefully

Identifiers such as Aadhaar numbers, government IDs and internal student IDs require careful purpose and access controls. Do not display a full identifier where a masked value or internal reference will do. Avoid putting sensitive identifiers into filenames, visible URLs or routine reports.

Narrative observations, disability or health information, safeguarding notes and predictive signals can create harm if exposed or misinterpreted. Separate highly sensitive records where appropriate, restrict exports and train staff to write factual, respectful notes.

Third-party integrations and audit trails

Every payment gateway, messaging provider, learning app, transport tool or analytics service expands the data flow. Maintain an integration register with the fields shared, purpose, owner, authentication method and review date. Disable unused connections and rotate credentials when staff or vendors change.

Audit trails should answer who viewed or changed important information, what changed and when. Logs need their own access and retention rules. They support investigation and accountability, but they should not become an uncontrolled second copy of sensitive data.

Responsible use of AI with student information

Do not paste identifiable student records into a public AI service without an approved purpose, contract and data-protection review. Understand whether prompts are stored, used for model improvement, exposed to subprocessors or transferred across jurisdictions.

When AI supports a prediction or recommendation, keep people in control. Provide the contributing evidence, allow correction, test for unequal impact and prohibit automated punitive or high-stakes decisions. The school should be able to explain the purpose and process in language a learner or parent can understand.

A 90-day governance starting plan

A school does not need to solve everything at once. Begin with the highest-risk and most widely shared data, establish ownership and create a repeatable review process.

1. 1. Days 1-30: know the data

   Inventory systems, spreadsheets, integrations, purposes, owners and existing notices. Remove obvious shared-account and public-link risks.

2. 2. Days 31-60: set controls

   Define roles, review vendor terms, approve transfer methods, establish incident contacts and draft retention schedules.

3. 3. Days 61-90: operationalise

   Train staff, test a rights or correction request, test an export and deletion workflow, and review one AI or analytics use case end to end.