The DPDP Act and your school - what principals need to know about student data

Every school in India holds a lot of personal information: children's names, dates of birth, photos, addresses, parents' phone numbers, marks, attendance, sometimes health details. Until recently, there were few clear rules on how that information must be handled.

That has changed. The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025, notified in November 2025, set out how organisations in India must collect, use and protect personal data. Schools are covered, and children's data gets extra protection.

This is a plain-language overview for principals and school owners. It is not legal advice; for decisions specific to your school, talk to a lawyer.

The basic idea: you are the "data fiduciary"

Under the Act, the organisation that decides why and how personal data is used is the data fiduciary. For student and parent data, that is your school.

Companies that handle the data on your behalf (your school app, your fee software, your cloud storage) are data processors. They act on your instructions, but the school remains responsible. That is why choosing vendors carefully matters so much.

The timeline

The Rules are being brought in step by step. Most of the day-to-day obligations for organisations, including consent, security safeguards, breach notification and the rules for children's data, apply from May 2027, about 18 months after the Rules were notified. Some parts, such as the setting up of the Data Protection Board, applied earlier.

That sounds far away, but changing how a school collects consent, stores records and chooses vendors takes time. Schools that start now will find it easy; schools that wait will be rushing.

What changes for children's data

Anyone under 18 is a "child" under the Act. Three rules matter most:

1. Verifiable parental consent. Before processing a child's personal data, an organisation must generally get consent from the parent or lawful guardian, and must be reasonably sure the person giving consent really is the parent.
2. No harm to the child. Data must not be used in a way likely to harm a child's well-being.
3. No tracking, behavioural monitoring or targeted advertising aimed at children.

The exemption for schools, and its limits

The Rules recognise that schools need student data to function. Educational institutions get a conditional exemption from the parental-consent requirement, for processing that is limited to their educational activities and to the safety of children enrolled with them.

The key word is limited. Taking attendance, sharing homework, publishing report cards and contacting parents about their own child are normal educational activities. But if student data is used for something else, such as marketing, sharing with an outside company that profiles students, or advertising, the exemption no longer covers it and the full rules apply.

In practice: use student data to run the school and keep children safe, and nothing else.

Five things every school should do now

1. Know what data you hold and where it is

Make a simple list: which information you collect (students, parents, staff), where it is stored (registers, Excel files, WhatsApp, school software, Google Drive), and who can access it. Many schools are surprised by how many copies of the same student list are floating around on personal laptops and phones.

2. Collect less

Only collect what you actually need. If a form asks for information nobody uses, remove the field. Less data means less risk.

3. Tell parents clearly

Parents should be able to understand, in simple language, what information the school and its tools hold about their child, why, and who can see it. A short privacy notice in English and your local language, plus a consent step in your parent app, goes a long way.

4. Secure it

The Act requires reasonable security safeguards. In plain terms:

• Each person logs in with their own account; no shared passwords.
• Teachers see only their own classes; parents see only their own children.
• Data is encrypted and backed up.
• Old staff lose access the day they leave.
• Student lists are not passed around on WhatsApp or pen drives.

Penalties for failing to protect data properly can be very large (up to Rs 250 crore under the Act for failing to take reasonable security safeguards), so this is not a box-ticking exercise.

5. Have a plan for a data breach

If personal data leaks (a lost phone with student records, a hacked account, a list shared by mistake), the Rules require the affected people and the Data Protection Board to be informed. Decide now who in your school handles this, and make sure your vendors will tell you quickly if something goes wrong on their side.

Questions to ask every software vendor

Because the school remains responsible, ask any app or software company these questions before signing:

• Where is our data stored? Is it in India?
• Who at your company can see our students' data, and why?
• Can a teacher see classes they do not teach? Can a parent see another family's child?
• Is our data backed up? How often?
• Do you use our data for advertising, or share it with anyone else?
• If we stop using your service, can we export our data, and will you delete it?
• How and how fast will you tell us about a data breach?
• Do you have a written agreement covering all of this?

A good vendor will answer these clearly and put them in writing. If a vendor is vague, treat that as an answer.

How SchoolFriend handles this

We designed SchoolFriend around these rules from day one:

• The school owns its data. We use it only to run the service, never for advertising, and never sell it.
• Teachers see only their own classes; parents see only their own children. Every school's data is kept separate from every other school's.
• Data is stored in India.
• Parents see a short privacy notice and give consent the first time they log in.
• Everyone logs in with their own mobile number and a one-time code. There are no shared passwords.

You can read more in our privacy policy. If you have questions about how SchoolFriend would handle your school's data, book a call and we will walk you through it.

This article is general information about the DPDP Act and Rules as of November 2026, not legal advice. Check the official text, or ask a lawyer, before making decisions for your school.