Updated · 6 min read · By the EduRit team
Short answer
Under the Digital Personal Data Protection Act 2023, a school is responsible for the personal data of its students, parents, and staff. For children under 18 it needs a parent's verifiable consent and must not track or target them with advertising, with some exceptions for a school's educational and safety work. Most duties apply from May 2027, and penalties go up to ₹250 crore.
This is a plain-language overview, not legal advice. Check your school's obligations with a lawyer.
Who is who
- The school is the data fiduciary: it decides why and how student, parent, and staff data is used, and it answers for it.
- Software vendors such as a school ERP are data processors: they handle the data for the school, under its instructions.
- Students, parents, and staff are data principals, with rights over their own data.
What schools need to do
- Tell people what you collect and why, in a clear notice.
- Get a parent's verifiable consent before processing a child's data, except where the law or rules allow otherwise.
- Collect only what you need, and use it only for that purpose.
- Keep the data secure, including with the vendors you use.
- Report a personal data breach to the Data Protection Board and to the people affected.
- Delete data once it's no longer needed for its purpose.
- Publish a contact for questions and complaints, and answer requests to see, correct, or erase data.
Children's data
Everyone under 18 counts as a child. Besides parental consent, the Act bars processing that could harm a child's well-being and bans tracking, behavioural monitoring, and targeted advertising aimed at children. The DPDP Rules 2025 exempt some school activities, such as educational work and child safety, from parts of these limits, within conditions.
When it applies
The DPDP Rules were notified in November 2025. Most duties, including notices, consent, security, and breach reporting, apply 18 months later, from May 2027. That leaves schools time to prepare, but not much to waste.
Penalties
| Failure | Penalty up to |
|---|---|
| Not taking reasonable security safeguards | ₹250 crore |
| Not reporting a data breach | ₹200 crore |
| Breaking the rules on children's data | ₹200 crore |
A checklist for your school
- List the personal data you hold, where it is kept, and who can see it.
- Update admission forms with a clear notice and parental consent.
- Limit staff access by role, and keep a record of changes.
- Check that vendors keep each school's data separate and children's photos private.
- Decide how long you keep records after a student leaves.
- Name the person who handles data questions and complaints.
How EduRit helps
- Each school's data is kept separate, and staff see only what their role allows.
- Changes to records and roles are recorded in an audit log.
- Photos and documents are private, opened only through links that expire within 30 hours.
- Your school owns its data; EduRit never sells it or uses it for advertising.
- When a school leaves, it can get its data exported, and the data is erased 90 days after the account is deleted.