Hudace guide
India notified the DPDP Rules on 14 November 2025 with an 18-month phased timeline. For schools, that runway ends in May 2027.
Admission forms, marks, health notes, photos, fees and transport stops are personal data, and the school decides how they are used.
Data about children needs verifiable consent from a parent, with limited exemptions for essential purposes such as education, healthcare and safety.
Give staff access by role, record who views student records, and keep a plan for informing people after a breach.
Parents can ask to see, correct or erase their data. The Rules give schools up to 90 days to respond.
Update the consent notice on admission forms you publish this winter, and keep only the data each purpose needs.
The DPDP Rules give Indian schools an 18-month runway ending in May 2027. What changes for parental consent, notices, security and data requests.
Book a SchoolOS demo Read the full guide