Applications, examination results, research datasets, hostel records and placement profiles: colleges and universities hold personal data across dozens of departments. The Digital Personal Data Protection (DPDP) Act applies to all of it.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every college, university and higher education institution that processes digital personal data in India. Here is what they mean in practice.
1. Departments are the hidden challenge
Central systems are usually the easy part. The difficulty is the spreadsheets, shared drives, research tools and portals run by individual departments, placement cells and hostels. A personal data inventory that covers them, not just the student information system, is where compliance starts.
2. Admissions, and students under 18
Applicants must receive a clear notice of what is collected and why. Some applicants and first-year students are under 18, and are children under the Act. Check dates of birth, and route those under 18 to verifiable parental consent where the Rules require it.
3. Examinations and results
Openly published marks lists with names, roll numbers and scores, and answer scripts handled carelessly, are common complaints. Share results with each student, or with minimal identifiers, and protect examination systems and scripts.
4. Research
Research involving people needs a documented basis, usually consent, ethics approval, and de-identification wherever possible. Research data should live in approved, access-controlled storage, not on personal laptops or unapproved cloud services, and data shared with partners should be covered by an agreement.
5. Placements and alumni
Sharing student profiles with recruiters needs the student’s agreement. Share only with students who opt in, and only what recruitment needs. Alumni contact details collected for records should not be used for fundraising without consent.
6. Proctoring, biometrics and AI
Online proctoring, facial recognition, biometric attendance and Artificial Intelligence (AI) tools in admissions or grading collect sensitive data and can produce unfair outcomes. Assess each one for necessity and impact, keep a person in the loop for decisions about students, and offer less intrusive alternatives where you can.
7. Security and breaches
Campus networks with thousands of users are frequent targets. Role-based access, prompt removal of leavers’ accounts and access logs are basic safeguards. A breach must be reported to the Data Protection Board of India and the people affected, with a detailed report within 72 hours.
A practical starting point
- Name the person accountable for DPDP compliance, with a contact in each department.
- Build an inventory that includes departmental systems.
- Check applicants’ ages and plan parental consent.
- Publish results to each student, not openly.
- Require approved storage and ethics approval for research data.
- Share placement profiles only with students who opt in.
vDPO’s free DPDP gap analysis for colleges and universities asks 35 questions written for higher education and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you an inventory to start from, DPIAs, a risk register and a breach register.
This article is general information, not legal advice.