The DPDP Act for schools: what it asks of you, and when.

Does the DPDP Act apply to schools?

Yes. The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, including data collected on paper and digitised later.^[1] Student, parent and staff records in a school database fit that description. We found no blanket exemption for schools in the Act or the Rules. There's a narrow carve-out for educational institutions, covered below.

The Act uses two terms. A Data Fiduciary decides why and how personal data is processed. For student records that's the school or its trust. A Data Processor handles data on a fiduciary's behalf, which is what a software vendor does.^[1] The school stays responsible for what its vendor does with the data, whatever the contract says, and may use a processor only under a valid contract.^[1]

Government schools are State bodies, and the Act treats State processing differently, for example on erasure (section 17(4)) and in the grounds for State functions in section 7. The Government can also notify classes of fiduciaries as exempt from some duties (section 17(3)).^[1] Check with your lawyer which of these reach you.

When do the DPDP Rules 2025 take effect?

The DPDP Rules 2025 were published in the Gazette as G.S.R. 846(E) on 13 November 2025, and they take effect in three stages: on publication, one year after it and eighteen months after it. Most duties for schools start at eighteen months, which we count as 13 May 2027.^[2]

The Act switches on by notification, section by section.^[1] We got the Act's dates from a secondary source, because we couldn't open the notification itself.^[3] The Government's own summary describes the same phasing, with an eighteen-month period for most compliance.^[4]

We found no change to these dates as of 21 October 2026, but dates can change by notification, so check MeitY's site before you rely on them. As of October 2026, 13 May 2027 is just under seven months away. Admission forms and vendor contracts take time to change.

Who is a child under the DPDP Act?

Anyone who hasn't completed 18 years.^[1] That covers nearly every school student. A student who turns 18 during Class 12 is an adult under the Act from that birthday, so your records need each student's date of birth to tell the difference.

For a child, the Act says the Data Principal includes the parent or lawful guardian, so it's the parent who gives consent and uses the rights listed below.^[1] The consent rule also covers a person with a disability who has a lawful guardian, and the guardian consents instead. Rule 11 asks the school to check that the guardian was appointed by a court, a designated authority or a local level committee under the guardianship law that applies.^[2]

What is verifiable parental consent?

Section 9(1) says that before processing any personal data of a child, the school must get the verifiable consent of the child's parent or lawful guardian.^[1] Rule 10 says the school must use appropriate technical and organisational measures to get that consent, and must check that the person who identifies as the parent is an identifiable adult. It can check against reliable identity and age details it already holds, against details the parent gives voluntarily, or against a virtual token from an authorised entity. That includes details verified through DigiLocker.^[2]

The consent itself must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose.^[1] The notice that comes with the request has to cover the following.^[2]

1. An itemised list of the personal data

2. The specific purpose for each use of it

3. Plain language, readable without any other document

4. How to withdraw consent, as easily as it was given

5. How to use the parent's rights, and how to complain to the Board

The request itself must be in clear, plain language. It must give the parent the option to read it in English or any language in the Eighth Schedule to the Constitution, and it must carry contact details for someone who can answer the parent's queries.^[1] If a dispute arises, the school has to prove that it gave the notice and got the consent.^[1] Keep a record you can produce.

If a parent withdraws consent, the school must stop processing within a reasonable time and have its processors stop, unless the law requires or allows the processing without consent. Processing done before the withdrawal stays lawful.^[1]

What does Section 9 ban, and is there an exemption for schools?

Section 9 sets two bans on top of parental consent. A fiduciary mustn't process a child's data in a way likely to harm the child's well-being, and mustn't track or behaviourally monitor children or show them targeted advertising.^[1] The Government can exempt classes of fiduciaries and purposes from the consent rule and the tracking ban.^[1] Rule 12 and the Fourth Schedule do that.^[2]

So the exemption is for the listed uses. It doesn't switch consent off for everything a school does.

The Government's plain-language summary is looser. It says parental consent is needed unless the processing relates to essential services such as healthcare, education or real-time safety.^[4] The Rules' text is narrower for educational institutions, as the table shows, and the Rules are the legal text.

What security and breach duties does a school have?

The Act requires reasonable security safeguards to prevent a personal data breach, covering data the school holds and data its processors handle.^[1] Rule 6 sets a minimum.^[2]

1. Data security measures such as encryption, obfuscation, masking or virtual tokens

2. Controls on who can access the computer systems

3. Logs and monitoring, so unauthorised access can be detected and investigated

4. Backups and measures to keep running if data is destroyed or access is lost

5. Logs and personal data kept for one year for those purposes, unless another law requires otherwise

6. Security terms in the contract with each processor

A “personal data breach” is wide. It means any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises the confidentiality, integrity or availability of the data.^[1] A results sheet emailed to the wrong class could fall within it. If one happens, rule 7 sets three steps. The first two are both “without delay” and the rule doesn't rank them, so do them together.^[2]

1. 1

   Tell the Board without delay

   Send a description of the breach: its nature, extent, timing, location and likely impact.
2. 2

   Tell each affected person without delay

   Use plain language and their registered contact. Say what happened, the likely consequences, what you're doing about it, what they can do to protect themselves and who to contact.
3. 3

   Send the Board detailed information within 72 hours

   That covers the events and reasons behind the breach, your mitigation and remedial measures, any findings about who caused it and a report on what you told the affected people. The Board can allow longer on a written request.

The Rules also require the school to publish contact details for someone who can answer questions about the processing.^[2] A formal Data Protection Officer is required only of Significant Data Fiduciaries, which the Government notifies.^[1]

How long can a school keep student data, and what can parents ask for?

Keep it only as long as the purpose is being served. The Act says to erase personal data when consent is withdrawn, or as soon as it's reasonable to assume the purpose is no longer served, unless the law requires you to retain it. Your processors must erase it too.^[1]

The Act allows you to keep data where that's necessary to comply with a law. Whether your board's record-keeping rules count, and which records to keep for how long, is a question for your lawyer.^[1] The fixed three-year erasure periods in rule 8(1) apply to large e-commerce, online gaming and social media companies, not to schools.^[2]

Rule 8(3) is separate and applies to every fiduciary. It says to keep personal data, related traffic data and logs of the processing for at least one year from the date of processing, so the State can call for them for purposes the Seventh Schedule lists. After that you must cause them to be erased, unless another law needs them kept longer.^[2]

Where the school uses data to make a decision about a student, or passes it to another body, it must keep that data complete, accurate and consistent.^[1] That matters for what you file with UDISE+ and APAAR.

A parent can ask what data you hold and who got it, ask you to correct, complete or update it, ask for erasure, and use your grievance process.^[1] The school must publish how to make a request, and must publish its grievance process with a response time of no more than ninety days.^[2]

Who enforces the DPDP Act, and what are the penalties?

The Data Protection Board of India enforces it. As far as practicable it works as a digital office, with complaints received and decided online.^{[1, 2]} A parent has to use the school's grievance process first before approaching the Board.^[1] The Board can also act on a breach report the school itself sends.^[1]

A penalty comes only after an inquiry finds the breach significant and the school has had a hearing.^[1] These are ceilings, not fixed fines.

The Board must weigh the nature, gravity and duration of the breach, the type of data, whether it was repeated, any gain or avoided loss, what the school did to limit the harm and how quickly, whether the penalty is proportionate, and its likely impact on the school.^[1] A school can appeal a Board order to the Telecom Disputes Settlement and Appellate Tribunal within 60 days.^[1] The Board can also accept a voluntary undertaking from a school, which bars further proceedings on what it covers.^[1]

Does the DPDP Act apply to APAAR IDs?

The Supreme Court said so on 20 July 2026. Any collection, processing, storage, retention, sharing or use of personal information under the APAAR scheme, it said, is strictly governed by the DPDP Act, and a scheme run administratively rather than by statute doesn't escape those obligations.^[5]

The order speaks to the authorities running the scheme. Your school still collects the consent form and the ID details, so treat them like any other child's data. The Court said this in July 2026, while most of the Act's duties don't start until 13 May 2027 under the dates above. The order doesn't explain how the two fit together. It also says information collected under the scheme can't be shared with any private entity or third party except in accordance with law and for authorised purposes.^[5] Our guide to UDISE+ and APAAR ID for schools covers the consent form and the opt-out.

What should you ask a software vendor that holds student data?

The school stays responsible when a vendor does the processing, and it needs a valid contract with the vendor.^[1] Ask these before you sign or renew, and get the answers in writing.

1. 1

   Where is our data stored, and in which country?

   The Government can restrict transfers to countries it notifies.^[1]
2. 2

   Who can see student data, in your company and ours?

   Rule 6 expects controls on access to the systems.^[2]
3. 3

   Is it encrypted when stored and when it travels?

   Encryption, masking and virtual tokens are the measures rule 6 names.^[2]
4. 4

   Do you log who accessed what, and for how long do you keep the logs?

   Rule 6 expects logs and monitoring, kept for a year.^[2]
5. 5

   How is data backed up, how often, and has a restore been tested?

   Rule 6 expects measures for continued processing after data is lost or destroyed.^[2]
6. 6

   How fast would you tell us about a breach?

   The school must tell the Board without delay and send detail within 72 hours, so write a prompt deadline for the vendor into the contract.^[2]
7. 7

   Which other companies touch our data, and where are they based?

   Think of SMS gateways, email services, push notifications, cloud hosts and document tools. The school answers for its processors, and the contract must carry security terms.^{[1, 2]}
8. 8

   What happens to our data when we leave, or when a record must be erased?

   The school must cause its processors to erase data.^[1] Ask for an export in a usable format and written confirmation of deletion.
9. 9

   Can you help us answer a parent's request to see, correct or erase a child's data?

   The school must publish how parents make these requests, and must answer grievances within the period it publishes, which can't exceed ninety days.^[2]
10. 10

    Does the system track or monitor children's behaviour, or use their data for advertising?

    Section 9 bans targeted advertising to children and limits tracking.^[1]
11. 11

    Has an independent party tested your security, and can you show us the report?

Sources

Every fact on this page about rules, prices or other products comes from one of these. We read each one on the date shown and will update this page when they change.

1. Gazette of India (Ministry of Law and Justice), copy hosted by the Ministry of Electronics and Information Technology. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) (meity.gov.in). 11 August 2023. Read 21 October 2026.
2. Ministry of Electronics and Information Technology, Gazette of India. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (meity.gov.in). 13 November 2025. Read 21 October 2026.The Gazette copy is dated 13 November 2025. PIB's backgrounder says the Rules were notified on 14 November 2025.
3. Wikipedia. Digital Personal Data Protection Act, 2023 (en.wikipedia.org). Read 21 October 2026.Secondary source. It cites the Act's commencement notification, G.S.R. 843(E) of 13 November 2025, which we could not open. It lists no later change to the dates.
4. Press Information Bureau (backgrounder). DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use (static.pib.gov.in). 17 November 2025. Read 21 October 2026.A plain-language government summary, not the legal text.
5. Supreme Court of India. Abhishek Baxi & Ors. v. Union of India, W.P.(C) No. 832/2026, record of proceedings (api.sci.gov.in). 20 July 2026. Read 21 October 2026.