DPDP Compliance Blueprint
Schools & Education
How schools, universities, and EdTech platforms must handle student and guardian personal data under the DPDP Act 2023.
Overview
Educational institutions collect extensive personal data about students — academic records, attendance, health information, and increasingly, behavioural data from digital learning platforms. The DPDP Act 2023 introduces specific protections for children's data, prohibiting processing that could harm minors and requiring verifiable parental or guardian consent for students under 18. Schools, colleges, universities, and EdTech companies must all comply.
Key DPDP Obligations for Schools & Education
Verifiable Parental Consent for Minors
For students under 18, consent must be obtained from a parent or legal guardian. The institution must take reasonable steps to verify that consent is given by an adult.
No Behavioural Tracking of Children
The DPDP Act prohibits processing children's data in a manner that could cause harm, including behavioural monitoring, profiling, or targeted advertising directed at minors.
Purpose Limitation for Student Records
Academic records collected for educational purposes cannot be shared with third parties — including employers, insurers, or marketing companies — without fresh consent.
Data Principal Rights for Students
Adult students (18+) can exercise rights directly. For minors, parents or guardians exercise rights on their behalf, including access, correction, and erasure.
EdTech Platform Obligations
Digital learning platforms acting as Data Processors for schools must be contractually bound to DPDP obligations and must not use student data for their own purposes.
Retention and Deletion
Student records must be retained only as long as necessary for the educational purpose. Post-graduation or post-enrolment, data must be deleted or anonymised per a defined schedule.
Consent for Minors: The Guardian Authorisation Framework
The DPDP Act's most significant impact on schools is the requirement for verifiable guardian consent before collecting any personal data about a student under 18. This applies to admissions forms, attendance systems, learning management platforms, and any third-party tool used in the classroom.
- Consent must be obtained from a parent or legal guardian, not the student
- The institution must verify the consenting person is an adult (e.g. via a signed declaration or digital verification)
- Consent must be specific to each data processing activity — one blanket form is insufficient
- Guardians must be able to withdraw consent and request deletion of their child's data
Student Data Retention Policies
Schools accumulate years of student records — exam results, disciplinary notes, health records, and financial data. DPDP compliance requires a formal retention schedule that specifies how long each category of data is kept and what happens when the retention period expires.
- Academic transcripts: retain for a defined period post-graduation (e.g. 10 years) then archive or anonymise
- Health and medical records: retain only as long as required by applicable health regulations
- Disciplinary records: delete after a defined period unless legally required to retain
- Financial records (fees, scholarships): retain per applicable tax and audit requirements
EdTech and Digital Learning Platforms
Schools increasingly rely on third-party platforms for learning management, video conferencing, and assessment. Each of these platforms processes student personal data and must be evaluated for DPDP compliance before deployment.
- Conduct a vendor assessment before deploying any EdTech tool that processes student data
- Ensure data processing agreements (DPAs) are in place with all EdTech vendors
- Prohibit vendors from using student data for advertising, profiling, or product improvement without consent
- Maintain a register of all third-party tools and the student data they access
Higher Education: Adult Students and Direct Rights
Universities and colleges dealing with adult students (18+) must provide direct rights management — students can access their own records, request corrections, and withdraw consent without going through a guardian.
- Provide a self-service portal for students to view and correct their personal data
- Process access and correction requests within the timeframe specified by the DPDP Rules
- Establish a grievance mechanism for students to raise data protection concerns
- Ensure alumni data is handled under a separate, post-enrolment consent framework
Penalty Exposure
Educational institutions that fail to obtain verifiable guardian consent for minors, or that allow EdTech vendors to misuse student data, face penalties under the DPDP Act 2023. Institutions classified as Significant Data Fiduciaries — typically large universities or national EdTech platforms — face additional obligations and higher scrutiny from the Data Protection Board.
Implementation Checklist
- Map all student data collection points and identify which involve minors
- Implement a guardian consent workflow for all students under 18
- Audit all EdTech and third-party tools for DPDP compliance
- Draft data processing agreements with all EdTech vendors
- Create a formal student data retention and deletion schedule
- Build a Data Principal rights portal for adult students
- Establish a guardian rights management process for minor students
- Train teaching and administrative staff on DPDP obligations
- Translate consent notices into relevant scheduled languages
- Designate a Data Protection Officer or compliance lead
Explore other sector blueprints
Ready to implement DPDP compliance for Schools & Education?
Priraksha automates consent collection, Data Principal rights workflows, and breach notification — purpose-built for the DPDP Act 2023.
Book a Demo