Every student in a school is a child under the Digital Personal Data Protection (DPDP) Act. That one fact shapes how schools must handle admissions, attendance, photos, bus tracking and the apps teachers use.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every school that processes digital personal data in India, from pre-primary to senior secondary. Here is what they mean for a school, and where most schools have gaps.
1. Parental consent, and the school exemption
Processing a child’s personal data generally needs verifiable consent from a parent or lawful guardian. The Rules exempt certain processing by educational institutions, for example for educational activities and for the safety of children. A school should verify the parent at admission, record consent where it is needed, and document where it relies on the exemption.
2. Tracking and monitoring
The Act prohibits tracking, behavioural monitoring and targeted advertising directed at children, unless an exemption applies. CCTV, bus location tracking, attendance systems and monitoring of school devices should each be listed, with the exemption relied on and the limits that keep them within it. Cameras have no place in toilets or changing areas.
3. Photos and publicity
Event photos on the website and social media are one of the most common sources of parent complaints. A line in the admission form is not enough: ask each parent separately, record the choice, and check it before publishing.
4. Messaging groups
Marks lists, report cards, fee reminders and parents’ phone numbers shared in class messaging groups expose children’s data to every other parent. Use the parent app or individual messages for anything personal, and set clear rules for teachers.
5. Apps and vendors
The school is responsible for the software and apps it chooses. Free learning apps may track children or show them advertising. Approve apps centrally, check their settings, and require vendors to confirm in writing that they do not track or target students or reuse their data. Contracts with the school management software, transport operator and other vendors must cover security, breach reporting and deletion.
6. Sensitive records and well-being
Health, counselling, special needs and disciplinary records should be kept separately, with access limited to the staff who need them. The Act also prohibits processing that harms a child’s well-being, so think twice before publicly displaying marks, rankings or disciplinary action.
7. Retention and breaches
Applications of children who never joined, records of students who left years ago, and old photos are often kept indefinitely. A retention schedule and an annual clean-up fix that. If a breach does happen, the school must inform the Data Protection Board of India and the parents affected, with a detailed report within 72 hours.
A practical starting point
- Name the person accountable for DPDP compliance.
- List every system, app, messaging group and paper register that holds student data.
- Verify parents and record consent where it is needed.
- List every form of tracking and monitoring and the exemption relied on.
- Ask parents separately about photos.
- Approve learning apps centrally.
vDPO’s free DPDP gap analysis for schools asks 35 questions written for schools and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you a student data inventory to start from, parent notices, DPIAs, a risk register and a breach register.
This article is general information, not legal advice.