DPDP Act for Schools: What Indian Schools Must Change Before May 2027

The DPDP Act for schools is no longer a future topic. The Government of India notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, and the Press Information Bureau release that announced them describes an 18-month phased compliance timeline. Counted from notification, that runway ends in May 2027, which for most Indian schools means the work has to be finished during the current academic year and the admissions season that follows it.

Schools hold more personal data than most businesses of their size: admission forms, birth certificates, health notes, photographs, attendance, marks, fee payments, transport stops and parent phone numbers. This guide explains what the Act and Rules ask of a school, in plain terms, and sets out a practical plan for principals, bursars and IT heads.

What does the DPDP Act mean for a school?

The Digital Personal Data Protection Act, 2023 was enacted by Parliament on 11 August 2023. It sets out the obligations of entities that handle digital personal data, called Data Fiduciaries, and the rights of individuals, called Data Principals. A school that decides why and how student, parent and staff data is processed is acting as a Data Fiduciary for that data.

The Act is built on seven principles named in the government release: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability. Each one maps to a daily school routine:

• Consent and transparency: parents know what the school collects at admission and why.
• Purpose limitation: data collected for transport routing is not reused for unrelated marketing.
• Data minimisation: forms ask only for what the school needs.
• Accuracy: records are corrected when a parent reports a change.
• Storage limitation: old applicant files are not kept forever without a reason.
• Security safeguards: access is limited by role and logged.
• Accountability: someone in the school owns the process and can show what was done.

If your school already follows a written data security policy, this is the moment to check it against these principles. Our guide to school data security covers the technical controls in more depth.

When do the DPDP Rules apply to schools?

The Rules were notified on 14 November 2025 and, according to the government release, provide an 18-month phased compliance timeline so organisations can make the transition smoothly. The Rules set out which duties start when, so read the commencement provisions alongside the main obligations on notices, consent, security, breach handling and data principal rights.

For a school, the practical reading is simple. Anything that depends on parents, such as new consent wording, collecting fresh permissions, or changing the admission form, needs to be ready before the admission cycle that opens closest to the deadline. Schools that run an April session in India will usually publish forms for the 2027-28 year from late 2026 or early 2027, so the forms you print or publish this winter should already carry the new notice.

Check the exact commencement dates for each rule in the official notification before you sign off your plan, and keep a dated record of the version you relied on.

Do schools need verifiable parental consent under the DPDP Rules?

Yes, in most cases. The government release states that Data Fiduciaries must obtain verifiable consent before processing the personal data of children, with limited exemptions for essential purposes such as healthcare, education and real-time safety.

That exemption is narrower than many schools assume. It covers processing that is essential to educating and protecting the child. It does not automatically cover everything a school does with data. A useful way to sort your processing is in three groups:

Where consent is needed, the Rules require it to be verifiable. In a school context that usually means the consent is given by a parent or guardian whose identity the school has already established at admission, and the school can show when and how it was given.

What must a school consent notice contain?

The Rules require Data Fiduciaries to issue standalone, clear and simple consent notices that explain the specific purpose for which personal data is being collected and used. For a school, that rules out a single line buried in the fee terms.

A workable school notice covers:

1. Who is collecting the data: the school or trust, with the contact for data queries.
2. What is collected: a short list grouped by category, such as identity, contact, academic, health and payment data.
3. Why: each purpose in plain words, such as admission, teaching, assessment, transport and fee collection.
4. Optional items: each optional purpose with its own choice, such as photographs in publications.
5. How to withdraw or change consent: a simple route, ideally the same parent portal or app the family already uses.
6. Rights and contact: how to request access, correction or erasure, and who answers.

Publish the notice in the languages your parents read. Keep previous versions with dates, because a parent who consented in 2026 consented to the 2026 notice.

What happens if a school has a data breach?

The government release states that in the event of a personal data breach, Data Fiduciaries must promptly inform affected individuals in plain language, explaining the nature and possible consequences of the breach, the steps taken to address it, and contact details for assistance. The release also describes the Data Protection Board as a fully digital institution where citizens can file and track complaints online, with appeals against its decisions lying with the Appellate Tribunal, TDSAT.

Schools should prepare before an incident, not during one:

• Name an owner: usually the principal or bursar, with IT support.
• Keep a contact map: which parent and staff groups can be reached, by which channel, within hours.
• Draft templates now: a plain-language parent notice and an internal incident log.
• Know your vendors: every system that holds student data, who hosts it, and how they will tell you about an incident.
• Practise once a year: a short tabletop exercise with the leadership team is enough to expose gaps.

How fast must a school answer a parent data request?

The DPDP framework gives individuals the right to access, correct, update or erase their personal data, and to nominate another person to exercise these rights on their behalf. The government release states that Data Fiduciaries must respond to all such requests within a maximum of 90 days.

In practice, most requests a school receives will be simple: a parent wants a copy of what is held, a corrected spelling, or an updated address. These should take days, not months. The harder cases are erasure requests for records the school must keep for legal or board reasons, such as admission registers or examination records. Your policy should explain which records are retained and why, so the answer to the parent is consistent.

The rules also require Data Fiduciaries to display clear contact information, such as that of a designated officer or Data Protection Officer, so people can raise queries. Put that contact on the website, the parent app and the admission form.

How does a school ERP help with DPDP compliance?

Compliance is mostly about knowing where data is, who can see it, and being able to prove what happened. A school ERP that keeps student, parent, staff and fee records in one place makes that far easier than a mix of spreadsheets, messaging groups and separate apps.

Look for these capabilities when you review your system:

• Role-based permissions: a transport coordinator sees routes and stops, not marks or health notes.
• Change history and audit trail: every edit to a record shows who made it and when.
• Data export: you can produce a copy of one family's data when they ask for it.
• Structured fields for consent: consent status and notice version are stored against the student record, not in an email inbox.
• Notification records: you can show which notices were sent to which parents, and when.

Hudace SchoolOS supports this with role-based permissions, change history and audit trails, data export, user-defined fields for recording consent status, and a notification audit, so a school can show who accessed or changed a record and what parents were told. You can see how the platform is organised on the SchoolOS core school page and the wider school management system overview.

What should schools do this term? A DPDP checklist

Use this as a working plan for the rest of the 2026-27 academic year:

1. Map your data (November to December): list every system and paper register that holds personal data, what it holds, who can access it and where it is hosted. Include the UDISE+ and board portals your staff use, because those exports often end up on personal laptops.
2. Classify your processing (December): sort activities into core education and safety, optional services, and marketing, as in the table above.
3. Rewrite notices and forms (January): produce the standalone consent notice and update the admission form before the next admission cycle opens.
4. Fix access (January to February): remove shared logins, set role-based access, and switch off accounts for staff who have left.
5. Agree vendor terms (February): confirm how each software provider protects data and reports incidents.
6. Publish a contact and a request route (February): a named contact and a simple way to ask for access, correction or erasure.
7. Prepare breach templates and run a drill (March).
8. Train staff (March to April): class teachers, front office and transport staff handle the most data.

If you are planning a system change at the same time, our guide to student data management covers record structures, and the SchoolOS demo page lets you see role-based access in a live setup.

This article explains the law in general terms and is not legal advice. Confirm your obligations against the notified Rules and take advice for your school's specific situation.