Data protection
DPDP Act 2023: What It Means for Indian Schools
A plain-language guide to the DPDP Act for schools: children’s data, parental consent, parents’ rights and what to ask your software vendor.
Schoolwale team Updated 2 min read
Schools hold some of the most sensitive personal data there is: children’s names, dates of birth, identity numbers, health notes and family details. The Digital Personal Data Protection Act, 2023 sets out how organisations must handle personal data in India. This is a plain-language overview, not legal advice; check the latest rules and talk to your adviser.
Schools are responsible for the data they collect
Under the Act, the organisation that decides why and how personal data is used is the data fiduciary. For student records, that is the school. Software vendors process data on the school’s behalf, so the school should choose vendors that make compliance practical.
Children’s data needs a parent’s consent
The Act gives special protection to children’s personal data and expects verifiable consent from a parent or lawful guardian before it is processed, with limits on tracking and targeted advertising. Record consent properly, for example for photographs and trips, and keep the answers.
Parents can ask for a copy, a correction or erasure
People whose data is processed have rights, including access to information about their data and correction and erasure where the data is no longer needed. Schools should be able to give a parent a copy of their child’s data and handle erasure requests, while keeping records the law requires schools to keep.
Collect less, protect more
Keep only what you need, limit who can see sensitive fields, and keep a record of who viewed or changed them. Identity numbers should be encrypted and shown masked by default.
- Encrypt Aadhaar, PEN and APAAR numbers
- Limit who can view them, and log every view
- Keep a change log nobody can edit
- Remove location data from photos before sharing
Questions to ask your software vendor
Can a parent download their child’s data? Can the school process an erasure request while keeping legally required records? Are consent answers stored and never overwritten? Who at the vendor can access school data, and is that access recorded?
Questions
- Does the DPDP Act apply to schools?
- Yes. Schools process personal data of students, parents and staff, so the Act applies to them as data fiduciaries.
- Do schools need parental consent for student photos?
- Schools should obtain and record parental consent before using a child’s photograph, and respect a parent’s choice not to consent.
- Can a school delete everything when a parent asks?
- Not always. Schools must keep some records by law, such as admission and result records. Other personal data can be erased once it is no longer needed.