DPDPA Compliance for Schools in India

No. Section 9(1) requires verifiable consent from the parent or lawful guardian before processing any student's data, and Rule 10 puts the due-diligence burden on you: you must take reasonable steps to confirm that the person consenting is an identifiable adult who genuinely is that child's parent or guardian. That means either identity details you already reliably hold, or a virtual token issued against verified identity by an entrusted entity. A tick-box, an unverified email link, or a signature with no identity trail will not survive scrutiny. Consent must also be itemised by purpose under Section 6 — academics, transport, medical, photography and marketing are separate asks, not one bundle. Note that a "child" is anyone under 18, so this covers your Class 12 students too; the day a student turns 18, consent shifts to them.

No — but the exemption is narrower than most schools assume. Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 read with the Fourth Schedule Part A(3) provides a limited carve-out for the educational institution, and Part A(5) covers a school-engaged transport provider, so tracking strictly necessary for the safety of the child — transport monitoring, campus premises security — remains permissible to that extent. The carve-out lifts Section 9(1) as well as 9(3) for that safety-restricted processing — not for marketing. What is not covered: analytics and advertising pixels on your website and app, engagement scoring inside ed-tech tools, remarketing lists built from enquiry data, admission campaigns aimed at students rather than parents, and posting identifiable student photographs to build the school's social media reach. Safety is a defence. Marketing is not.

You are. The school is the Data Fiduciary; your LMS vendor, fee gateway, biometric attendance provider, yearbook photographer and bus operator are Data Processors acting on your instructions. Liability for their processing stays with you and cannot be contracted away — you need written contracts, purpose limits, deletion obligations on exit, and a list of who holds what. Two things schools commonly get wrong here: assuming medical records and biometrics fall under a stricter separate regime (DPDPA has no "sensitive personal data" category — one standard applies to everything), and leaving alumni databases and rejected-applicant files sitting in a vendor's cloud years after the purpose ended.

Two clocks start together and both must be met. CERT-In requires reporting of covered cyber incidents within 6 hours of detection. Separately under DPDPA, you must intimate affected parents and students without delay (Rule 7(1)), give the Board an initial description without delay (Rule 7(2)(a)), and file detailed particulars within 72 hours (Rule 7(2)(b)). On penalties: failure to observe the Section 9 obligations for children's data attracts up to ₹200 crore; failure to give the required breach intimation under Section 8(6) is assessed separately at up to ₹200 crore; and failure to maintain reasonable security safeguards attracts up to ₹250 crore — one incident can expose you under more than one head. One relief: the heavier Rule 13 obligations — annual DPIA, independent data audit, algorithmic due diligence, appointing an India-based Data Protection Officer — apply only to Significant Data Fiduciaries, which is a status the Central Government confers by notification. It is not automatic on student count. Every school still owes the baseline duties regardless.