A DPDP checklist for schools: what the student data rules mean for you

Think about what a school knows about one child. Name, date of birth and photo. Both parents’ phone numbers and address. Marks, attendance, fee history and perhaps a scholarship. A note about an allergy in the infirmary record, a remark about behaviour in the class teacher’s file. Multiply that by every student, every parent and every staff member, and a school holds some of the most sensitive personal data in its community, much of it about children.

The Digital Personal Data Protection Act, 2023, usually called the DPDP Act, sets the rules for how that data is collected, used, protected and deleted. Here is what it means for a school in practice, in plain words. It is a practical overview, not legal advice; your own legal adviser can confirm how the law applies to your school.

When does the DPDP Act apply?

The Act was passed in 2023, and the DPDP Rules were notified on 13 November 2025, when the Data Protection Board was also set up. The obligations come into force in stages. Most of the duties that matter for schools, including notices, security safeguards, breach reporting, retention and the extra care for children’s data, apply from about May 2027. That sounds far away, but changing forms, consent processes and staff habits across a school takes time.

What counts as personal data in a school

Personal data is any information about an identifiable person. In a school that includes names, photos, phone numbers, addresses, marks, attendance, fees and medical notes, whether they sit in a software system, a spreadsheet, an email or a class WhatsApp group. The Act covers digital personal data, and paper records that are later scanned or typed in become digital too.

Who is responsible for what

Under the Act, your school is the Data Fiduciary: it decides what data is collected and why, and answers to parents, staff and the Data Protection Board. Software providers that store and process data for the school, such as your ERP or LMS, are Data Processors: they act on the school’s instructions and must keep the data secure. Compliance is shared, but the school cannot hand its responsibility to a vendor.

What the rules ask of schools

The penalties are serious: up to ₹250 crore for failing to keep reasonable security safeguards, and up to ₹200 crore for breach-notice failures or breaking the rules on children’s data.

The Rules include narrow exemptions for schools, for example for educational activities, for children’s safety and for tracking the school bus on the way to and from school. They are limited to those purposes. Uses such as publishing a child’s photo on social media or sending promotional messages still need a parent’s consent.

Where schools usually have gaps

Most schools are not careless with data. The gaps come from everyday habits that grew up before anyone thought about a data law:

• Class WhatsApp groups where every parent can see every other parent’s number
• Student lists exported to spreadsheets, emailed and copied to pen drives
• One shared login for the office computer, so nobody knows who changed what
• Photos of children posted on social media without a specific consent
• Old records of students who left years ago, kept with no clear reason
• No named person to handle a parent’s question about their data

A checklist to start with now

1. Name a data protection contact at your school: someone who handles data questions from parents and staff.
2. Map your data. List what you collect, where it is kept (software, spreadsheets, paper, phones) and who can see it.
3. Tighten access. Give each person their own login, and limit what each role can see. A subject teacher doesn’t need medical or fee records.
4. Review your admission form and add a clear notice. Separate optional uses, such as photos for publicity, so parents can say yes or no to each.
5. Move parent communication off personal phones to a channel where numbers stay private.
6. Talk to your software vendors. Ask the questions below and get the answers in writing.
7. Agree a breach plan: who finds out, who decides, and who informs parents and the Board.
8. Set retention periods for each type of record, and a routine for deleting what is no longer needed.

Questions to ask your school software vendor

• Where is our data stored, including backups and logs?
• Who owns the data, and what happens to it if we leave?
• Is any student data used to train AI models?
• Is our data ever sold or shared for marketing or advertising?
• How quickly will you tell us about a breach, and with what information?
• Will you sign a Data Processing Agreement with your commitments in writing?
• What is your plan, with dates, for consent and parent-rights tools?

Be careful of any vendor that claims to be “DPDP certified”. There is no official DPDP certification. Written commitments, an agreement and a clear plan tell you far more.

How Schoolcanvas approaches it

Schoolcanvas is DPDP-ready school software. The data belongs to the school, and we process it only on the school’s instructions. Some protections are in place for every school today: data is hosted on a private cloud in a tier-IV data centre in India with four backup copies, every user sees only what their role allows, teacher and parent phone numbers are hidden from each other, and early-leaving gate passes are verified by an OTP sent to the parent.

We also make eight written commitments to every school, ready for its Data Processing Agreement: your instructions only, never used to train AI, never sold or shared, no ads or adtech, stored in India, every school kept separate, openness about our service providers, and your data returned, then deleted with a Certificate of Deletion, if you leave. Our DPDP programme began on 1 October 2026. Consent capture, verifiable parental consent, parent self-service and an audit trail are planned phases on our roadmap, which you can see in how Schoolcanvas ERP is DPDP-ready.

The same rules apply to the teaching side. In Assist, our AI-powered LMS, student data is never used to train public AI models; our post on AI tools for teachers covers how AI is used there. For the rest of the platform, start with the products overview.

Ask about data protection in a free demo and we will walk you through our DPDP document for school leaders and who does what.