Parental consent
Students under 18 are children. Verifiable parental consent is needed where the DPDP Rules require it, and the Rules exempt some processing by educational institutions.
Schools
Every student is a child under the DPDP Act. Schools need to show how they protect that data.
Schools hold admission files, marks, health and counselling records, photos, bus locations and parents’ details, spread across offices, classrooms, apps and messaging groups. vDPO helps you find the gaps and fix them before they become complaints.
The DPDP Act
What it means for schools
The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 apply to every organisation that processes digital personal data in India. These are the areas that need the most attention in this sector.
Tracking and monitoring
Tracking or monitoring children is prohibited unless an exemption applies. CCTV, bus tracking and attendance systems must stay within educational activities and safety.
Photos and publicity
Publishing students’ photos needs each parent’s agreement. Blanket consent in the admission form does not cover it.
Apps and vendors
The school is responsible for the apps and software it uses. Vendors must not track students, show them advertising or reuse their data.
Messaging groups
Marks, reports and phone numbers shared in class groups are a common source of breaches and complaints.
Breaches
A breach must be reported to the Data Protection Board of India and the parents affected, with a detailed report within 72 hours.
vDPO
What vDPO gives schools
Start with the free gap analysis. A client workspace then turns the gaps into an inventory, notices, assessments and registers you can keep up to date.
Gap analysis
Answer 35 questions written for schools and get a score, the gaps found and the corrective action for each. Free, with no login.
Start gap analysisPersonal data inventory
Start from a list of the activities, systems and recipients typical of schools, then confirm or edit each one.
Privacy notice and retention schedule
A plain-language privacy notice for each group of people, and a retention schedule, written from the inventory.
Data Protection Impact Assessments
Assess new systems and uses of personal data, with questions for schools alongside the standard ones.
Risk register
Turn gap analysis answers into risks, and add the risks schools commonly face as a starting list.
Breaches, requests and grievances
A breach register with the 72-hour countdown and draft notices, and a log of requests and grievances with their due dates.
What the DPDP Act Means for Schools
Every student is a child under the DPDP Act. Parental consent, tracking, photos, messaging groups and apps: what schools need to get right.
Read the article