DPDP for EdTech, Universities and Schools: What Changes, What Hurts, and What to Do Before May 2027
Few organisations hold as much personal detail about a child as a school does. Almost none of it has ever been mapped.
Think about one admission file: a birth certificate, a parent's ID copy, a transfer certificate, a medical note, a photograph, sometimes a category or income certificate. Then the school adds attendance, marks, behaviour remarks, fee receipts, bus routes, CCTV footage, counselling notes and a WhatsApp group where mark lists get shared. It all sits across five or six systems and a few thousand loose files.
I have spent years around principals, registrars, admission heads and edtech founders, and the pattern is consistent. People in education understand duty of care deeply. What they have never had is a law that makes the institution account for student data, field by field.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 change that. This article covers what the law says for schools, universities and edtech companies, where the real friction lies, and how to get ready without turning your admissions office into a legal department.
Why education is the hardest sector to get right
Banks and telecom companies deal with adults. Education deals mostly with children, and the Act treats anyone under 18 as a child (Section 2(f)). That one definition reshapes everything. A Class 9 student is a child. So is a first-year undergraduate who is 17. A postgraduate is an adult.
Figure 1: The four roles that decide most DPDP questions on a campus.
The Act sorts everyone into roles. The student, and the parent or lawful guardian acting for a child, is the Data Principal. The school, college, university or trust that decides why and how data is used is the Data Fiduciary. The ERP vendor, fee gateway, transport tracker and proctoring tool are Data Processors. The Data Protection Board is the regulator.
Two points catch institutions off guard. Under Section 8(1) the school remains responsible for what its vendors do with the data. And "institution" is rarely one legal entity: a trust runs the school, a society runs the college, a university affiliates dozens of colleges. Because a Data Fiduciary is whoever determines purpose and means, alone or jointly, several entities can carry responsibility for the same student's data.
The Act covers digital personal data, including paper records that are later digitised. A school digitising decades of records is creating compliance exposure with every scan.
The calendar: less time than it looks
The Rules were notified on 13 November 2025 and commence in phases.
Figure 2: Phased commencement of the DPDP Rules, 2025.
The Board's machinery began in November 2025. Consent Manager registration opens on 13 November 2026. The substantive duties on schools and universities, including notice, consent, security safeguards, breach reporting, children's data rules and Data Principal rights, commence on 13 May 2027. Penalties attach from that date. As of today, that is 216 days away.
Education leaders should underline this: admissions for the 2027-28 session open before May 2027. The forms, consent flows and vendor contracts you use this winter are the ones the law will judge from day one.
The heart of the matter: Section 9 and children's data
Section 9 is where education parts ways with every other sector. It does four things.
- Section 9(1): before processing a child's personal data, the Data Fiduciary must obtain verifiable consent of the parent or lawful guardian.
- Section 9(2): no processing that is likely to cause a detrimental effect on the well-being of a child.
- Section 9(3): no tracking, behavioural monitoring or targeted advertising directed at children.
- Section 9(4): the Government may exempt certain classes and purposes from 9(1) and 9(3), through the Rules.
Rule 10 explains what "verifiable" means. The institution must take appropriate technical and organisational measures and check that the consenting person is an identifiable adult, through reliable identity and age details it already holds, or through details or a virtual token issued by an authorised entity, DigiLocker being the familiar example. Schools have an advantage here, because they already collect parent identity documents at admission. The task is to turn that moment into a recorded, auditable consent rather than a signature on page six of a form.
The Fourth Schedule: narrow, and often misread
Rule 12 and the Fourth Schedule contain the exemption schools care about. It is often summarised as "educational institutions are exempt". That is wrong, and the mistake is expensive.
Figure 3: How Section 9, Rule 10 and the Fourth Schedule fit together.
Part A, entry 3 of the Schedule covers an educational institution, defined as an institution of learning that imparts education, including vocational education. But it applies only where processing is restricted to tracking and behavioural monitoring for the institution's educational activities, or in the interests of safety of enrolled children. It does not cover admission records, fee data, marks, medical files or photographs. For those, Section 9(1) still applies.
| What the school wants to do | Where it stands under the Act and Rules |
|---|---|
| Monitor attendance and participation on its own learning platform | Fits the "educational activities" limb of Part A(3), if kept to what is necessary |
| Use CCTV and campus access systems for child safety | Fits the "safety of enrolled children" limb of Part A(3) |
| Let a bus operator track children's location during travel to and from school | Covered for the operator under Part A(5), for that journey only |
| Collect and store admission, fee, marks and health records | Needs verifiable parental consent under Section 9(1) |
| Build behavioural profiles of students to feed marketing | Outside the exemption; Section 9(3) prohibits it |
| Run any processing likely to harm a child's well-being | Never exempt; Section 9(2) sits outside the Schedule |
Every exemption in the Schedule is tied to necessity. A school is not exempt because it is a school. It is exempt for specific monitoring, for specific purposes, to the extent necessary.
Where student data actually lives
Ask an institution where it holds personal data and the first answer is "the ERP." The honest answer is much longer.
Figure 4: Eight places to find before anyone asks you to prove what you hold.
Beneath the ERP sit scanned admission files, fee gateway exports, biometric devices, CCTV recorders, bus tracking portals, health room registers, hostel and placement portals, and the shadow layer of WhatsApp groups, Google Forms and spreadsheets on personal laptops. Section 8(3) expects data used for decisions affecting a student, such as results, to be complete, accurate and consistent. That is hard to show when one record exists in four places with four spellings of the child's name.
The real challenges nobody puts in the brochure
These are the issues I see repeatedly.
1. Verifiable consent at scale, in messy family situations. Who is the parent when parents are separated? What about a ward in a hostel, a child under a guardian, or a student with a disability who has a lawful guardian? Admission teams need a written rule for each case before the first dispute arrives.
2. The student who turns 18 mid-course. A child's data is processed on a parent's consent. On the day the student turns 18, the student becomes an adult Data Principal. Sensible practice is to issue a fresh notice and refresh consent at that point, rather than assume the parent's earlier consent carries forward indefinitely.
3. No "legitimate interest" or "contract" shortcut. Unlike some other regimes, the DPDP Act has no general ground for processing because it is needed to perform a contract or serves the institution's interest. Most processing rests on consent or on the narrow "certain legitimate uses" in Section 7, such as State benefits, legal obligations, medical emergencies and employment. Consent must be free, specific, informed, unconditional and unambiguous (Section 6). A school cannot make admission conditional on agreeing to photos in marketing material.
4. Learning analytics and proctoring. Adaptive learning, engagement scoring and exam proctoring all involve tracking or behavioural monitoring. For a school using them for educational activities, Part A(3) offers room. A vendor that merely supplies software is a processor and must stay within the school's instructions. Whether an edtech company counts as an "institution of learning" depends on facts, and no one should assume it does.
5. Lead generation and marketing to children. Coaching and edtech companies run on funnels. Targeted advertising directed at children is barred by Section 9(3), and no exemption covers it. Lead lists built from minors' data and retargeting based on a child's behaviour need a hard look.
6. Retention versus the duty to erase. Section 8(7) requires erasure once the purpose is served or consent is withdrawn, unless retention is necessary to comply with law. Education has real record-keeping duties: transfer certificates, mark sheets, degree verification, audit trails. The work is mapping each category to a legal retention reason and deleting what has none. Old scans of unsuccessful applicants are usually the first candidates.
7. Public disclosure habits. Merit lists on notice boards, rank lists with sequential roll numbers, hostel allotment lists, "student of the month" posts. Each shares personal data. Some are justified. Many are just habit.
8. Breach readiness in thin IT teams. Ransomware against universities and school ERPs is not rare. From 13 May 2027, a breach triggers notice to affected individuals and the Board without delay, with detailed particulars to the Board within 72 hours (Rule 7), and Rule 6 requires logs to be kept for a year. A school with one IT administrator and no incident plan will find 72 hours short.
9. Vendor sprawl and cross-border hosting. Section 16 permits transfer of personal data outside India except to countries the Government restricts, but sectoral rules may be stricter. Many edtech tools run on foreign cloud. If your contract does not say where student data sits, neither can you.
10. Rights requests that arrive in bulk. Parents invoke access, correction and grievance rights around result day and fee disputes. The Rules allow up to 90 days for grievance redressal, but a school that cannot find a student's data across systems will struggle even then.
Schools, universities and edtech: same law, different pressure points
| Schools | Universities and colleges | EdTech and coaching platforms | |
|---|---|---|---|
| Typical Data Principals | Mostly children and parents | Mix of 17-year-olds and adults, plus researchers | Children, parents and adult learners |
| Main exposure | Children's consent, CCTV, transport, health files | Large alumni and applicant databases, research data, placement sharing | Behavioural tracking, ads, lead generation, foreign hosting |
| Likely exemption support | Part A(3) and A(5) for specific monitoring | Section 17(2)(b) for research and statistical use, if no individual decisions follow | Narrow, depends on whether it is an educational institution |
| Biggest trap | Assuming the school exemption is blanket | Treating affiliated colleges as someone else's problem | Treating students as an audience to be profiled |
At the larger end, the Government can designate a Significant Data Fiduciary based on volume and sensitivity of data and risk to rights. A national edtech platform holding millions of minors' records could attract that, bringing a Data Protection Officer in India, an independent audit and annual impact assessments. The Act also reaches overseas providers offering services to students in India.
What is at stake
Figure 5: Maximum penalties per instance under the Schedule to the Act.
The Act caps penalties at up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹200 crore for breaching the children's data obligations. These are ceilings, set by the Board after an inquiry. Notice that the highest two are safeguards and children, which is a school's entire risk profile in one chart. As of September 2026 no Board Chairperson or Members had been reported as appointed, so enforcement practice is still unwritten. I would not take comfort from that. Parents, affiliating universities and partner institutions will ask questions long before the Board does.
A 90-day plan an institution can actually run
| Window | Focus | What you produce |
|---|---|---|
| Days 1 to 15 | Ownership | A named privacy lead, a small working group across admissions, IT, academics, transport, HR and finance, and a published grievance contact |
| Days 16 to 40 | Discovery | A data inventory covering ERP, scans, devices, vendors and WhatsApp groups, with an owner against each system |
| Days 41 to 60 | Consent and notice | A redesigned admission form and parent notice in plain language and the regional languages you serve, with recorded parental consent |
| Days 61 to 75 | Vendors and retention | Ranked vendor list, updated contracts for the top ten, and a retention schedule |
| Days 76 to 90 | Resilience | A tabletop breach drill, access reviews, log retention checks and an evidence folder |
After 90 days you will not be finished, but you will be defensible, which is what the next admissions cycle needs.
Where VaultDef fits
Process comes first. A privacy lead, a data map and honest conversations with your transport head and ERP vendor cannot be bought. But once the first mapping is done, the problem is keeping it alive on a campus where new tools, vendors and batches arrive every year. That is where software earns its place.
VaultDef is a data protection platform built in India by a team with hands-on experience across offensive security, defensive security and compliance. Its suite covers capabilities that map closely to the challenges above.
| Campus challenge | VaultDef capability |
|---|---|
| Not knowing where student data sits | Automated data discovery and classification, so scans, databases and shared drives are found rather than remembered |
| No Record of Processing Activities | RoPA and data mapping, with each activity, purpose, system and recipient recorded |
| Parental consent and notices | Consent and notice management that records what each Data Principal agreed to and when, including withdrawals |
| Parents' access, correction and grievance requests | Data Principal rights workflow with tracked requests and response times |
| Vendor and hosting risk | Vendor and cross-border tracking, so you know which processors hold data and where |
| High-risk processing such as proctoring or analytics | DPIA support for assessing risk before rollout |
| Breach within 72 hours | Breach workflow that brings detection, decisions and notifications into one place |
| "Prove it" from a regulator, a university or a parent | A tamper-evident evidence trail, so the dated proof exists before anyone asks |
VaultDef will not decide who the lawful guardian is in a custody dispute or write your admissions policy. It turns that policy into something traceable and repeatable. To begin, read our DPDP audit readiness checklist, then see it applied to your own environment. The demo connects to a sample of your schema, runs a live scan and leaves you with a gap assessment. You can book a demo here.
The closing thought
Schools are trusted with children at their most impressionable. The DPDP Act asks them to extend that trust to the children's information: know what you hold, say why, ask the right adult, protect it, and delete it when it has done its job.
The institutions that struggle in 2027 will be the ones that waited for perfect clarity. Start with one question this week: where, exactly, does a student's data live in your institution? Everything else follows from the answer.
