DPDP Act Compliance for Indian Schools: Your 2026 Action Checklist

Why DPDP Applies Forcefully to Schools

India's Digital Personal Data Protection Act was passed in 2023 and its implementing rules were notified in early 2025. Compliance obligations have been coming into active enforcement through 2025 and into 2026. The Data Protection Board of India — the regulatory body established by the Act — is now operational.

Schools occupy a particularly sensitive position under this law. On any given school day, your institution processes personal data across dozens of touchpoints: admission forms collect addresses and financial information, attendance systems capture daily presence or biometric data, CCTV records movement within premises, fee systems hold bank details and payment history, health records capture medical conditions, and academic records document a child's cognitive and behavioural development over years.

Under the DPDP Act, any organisation that determines the purpose and means of processing personal data is a Data Fiduciary. Schools fit this definition straightforwardly — and because your students are predominantly under 18, your school is further classified as processing children's personal data, which carries the highest tier of protection obligations under the Act.

The consequences of non-compliance are not hypothetical. Penalties under the DPDP Act can reach Rs 250 crore per category of violation. Beyond financial penalties, a data breach or consent violation involving student data is a reputational event that affects parent trust, admissions, and the school's standing with the board of education.

This is not a matter of box-ticking for regulators. Schools hold some of the most sensitive personal data in Indian society — data about children. Getting this right matters.

What Counts as "Personal Data" in a School

The DPDP Act defines personal data broadly: any data by which an individual can be identified. In a school context, this covers far more than most administrators initially assume.

Student-level personal data your school holds:

• Name, date of birth, gender, nationality, religion
• Admission number, roll number, class, section
• Home address, parent contact numbers, email addresses
• Academic marks, grades, exam results, progress reports, report cards
• Attendance records (daily, class-wise)
• Behavioural records, disciplinary incidents, counsellor notes
• Medical records, health conditions, special needs documentation
• Photographs (individual and group)
• Biometric data — fingerprints, facial recognition data (if you run biometric attendance)
• CCTV footage in which the student is identifiable
• Fee payment history, bank account details (if parents pay via bank transfer)
• Transport route, pick-up and drop points
• APAAR (Academic Bank of Credits) ID or Aadhaar linkages (where applicable)

Staff personal data (also covered): salary slips, tax documents, performance reviews, bank account details, Aadhaar (if collected), health insurance records.

Every piece of data in the above lists is personal data under DPDP. Every system that stores it — your school management software, your accounting software, your WhatsApp group chats, your CCTV DVR, your physical admission files — is part of your data processing footprint.

The 7 Core Obligations Every School Must Meet

Special Rules for Children's Data

The DPDP Act treats children — defined as individuals under 18 years of age — as a special category requiring enhanced protection. For schools, whose student populations are entirely composed of children, these provisions are central, not peripheral.

Verifiable parental consent is mandatory. Before processing any personal data of a child, the school must obtain verifiable consent from a parent or legal guardian. "Verifiable" means you need to confirm that the person giving consent is actually the parent or guardian — not just anyone claiming to be. Admission forms that include a consent section are a starting point, but the mechanism for verifying identity matters too.

No targeted advertising to children. Schools must not share children's data with any platform or vendor for the purpose of delivering targeted advertising based on their personal data. If your school uses any third-party tools (educational apps, communication platforms) that might be serving targeted advertisements, you need to review those vendor agreements.

No behavioural profiling of children for advertising or other non-educational purposes. Academic profiling for educational improvement is expected to be permitted under the rules, but commercial profiling is not.

Biometric data requires extra care. Biometric data — fingerprints, facial recognition templates — is inherently sensitive. Collecting and processing biometric data from children requires explicit, informed consent and strong technical safeguards. If your school runs biometric attendance for students, your consent process for biometric specifically needs review.

"When we switched to biometric attendance for students, we thought it was simply an operational upgrade. When our legal advisor walked us through DPDP, we realized we needed separate parental consent forms specifically for biometric, a separate data retention policy, and new clauses in our vendor agreement with the biometric device provider. It was more than we expected." — Nandita Iyer, Principal, a 900-student CBSE school in Pune

Vendor Due Diligence: Your School Software Provider Is Now a Data Processor

One of the most important and least-discussed aspects of DPDP for schools is the Data Processor obligation. Under the Act, when your school engages a third party to process personal data on your behalf — your school management software provider, your WhatsApp messaging service, your CCTV cloud storage provider, your online exam platform — that third party becomes a Data Processor.

You, as the school, remain the Data Fiduciary. You are responsible for ensuring your Data Processors handle student data appropriately. This means:

• Written contracts are required. You should have a Data Processing Agreement (DPA) or equivalent contractual clauses with every vendor that handles student data. The contract should specify what data is processed, for what purpose, for how long, and the security standards that apply.
• You cannot outsource your DPDP obligations. If your software vendor suffers a breach, you as the school may face regulatory scrutiny. Choosing vendors with strong security practices, clear breach notification processes, and explicit DPDP commitments is now part of your due diligence.
• Audit your vendor list. Make a list of every third-party tool or service that touches student data. This includes obvious ones (your ERP, your SMS gateway) and less obvious ones (Google Workspace, parent communication apps, online assessment platforms, library management software, CCTV cloud services).

The Practical Compliance Checklist (15 Items)

Use this checklist as a starting point for your school's DPDP readiness review. This is not exhaustive, and your specific situation may require additional steps — engage a legal or compliance professional for a complete assessment.

How EdunodeX Helps Schools Meet DPDP Requirements

DPDP compliance ultimately rests with your school — no software vendor can do it for you. But the right school management platform makes the compliance posture substantially easier to maintain. Here is how EdunodeX is designed with these obligations in mind.

Consent management is built into the admission flow. EdunodeX captures and stores consent at the point of admission, with a clear record of what was consented to and when. This creates the audit trail that DPDP accountability requires.

Biometric access is consent-gated. The platform enforces a consent check before any biometric data — face recognition or fingerprint — is used for attendance processing. A student whose biometric consent has not been recorded cannot have biometric attendance taken, preventing accidental violation.

Role-based access controls limit data exposure. Not every staff member needs access to every piece of student data. EdunodeX's role system ensures that teachers see class data, accountants see fee data, and sensitive fields are restricted to authorised roles — reducing the blast radius of any accidental data exposure.

Data is encrypted at rest and in transit. All student personal data stored in EdunodeX is encrypted. Communication between your school and EdunodeX servers uses encrypted connections. Payment credentials and gateway secrets are encrypted with an additional layer of key-based encryption.

We operate as your Data Processor. When your school uses EdunodeX, we are your Data Processor and you are the Data Fiduciary. EdunodeX's data processing practices are governed by our Data Processing Agreement, available to all school customers on request. We are committed to notifying school customers of any breach promptly, consistent with DPDP obligations.

We would encourage every school evaluating school management software in 2026 to ask every vendor — including us — two questions: "What is your breach notification process?" and "Can I see your Data Processing Agreement?" The answers will tell you a great deal about how seriously a vendor takes your school's compliance obligations.