Skin
Free gap analysis · Higher Education

DPDP Gap Analysis for Colleges and Universities

Measure your institution’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to universities, deemed universities, colleges, autonomous institutes, professional and technical institutions, and other higher education providers operating in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the institution assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the institution identified when it acts as a Data Fiduciary and when as a Data Processor, for example for affiliated colleges, research sponsors or government schemes?
03 Are data protection responsibilities defined across admissions, examinations, academic departments, research, placements, hostels, finance and IT?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Personal Data Inventory and Mapping
05 Has the institution identified the personal data it holds about applicants, students, parents, faculty, staff, research participants and alumni?
06 Has the institution documented the purposes for processing personal data, including admissions, teaching, examinations, research, placements, hostels, scholarships and alumni relations?
07 Has the institution mapped how personal data flows between the student information system, learning platforms, examination systems, research tools and external portals?
08 Does the institution maintain an inventory of systems, databases and vendors that store or process personal data, including those run by departments?
09 Has the institution identified personal data shared with regulators, affiliating universities, scholarship portals, recruiters, research partners and other recipients?
3. Notices and Consent
10 Does the institution give clear privacy notices to applicants, students, staff and research participants?
11 Has the institution identified which processing relies on consent and which on a legitimate use or exemption under the DPDP Act and Rules?
12 Does the institution obtain separate consent for optional uses, such as sharing profiles with recruiters, marketing, photos and alumni fundraising?
13 Can students and others withdraw consent easily, and does the institution act on it across departments and vendors?
14 Does the institution identify students under 18 and obtain verifiable parental consent where the DPDP Act and Rules require it?
4. Examinations, Research and Placements
15 Are examination records, answer scripts and results protected, and are results published without exposing more than necessary?
16 Is personal data used in research covered by consent or another documented basis, ethics approval and de-identification where possible?
17 Does the institution share student data with recruiters and placement partners only with the student’s agreement and only what is needed?
18 If online proctoring, facial recognition or biometric attendance is used, has its necessity and privacy impact been assessed?
19 Are hostel, health and counselling records restricted to the staff who need them?
5. Rights and Retention
20 Can students, staff and others obtain a summary of their personal data, correct or update it, and request erasure where the law allows?
21 Does the institution have a procedure for verifying, tracking and responding to requests and grievances?
22 Has the institution defined retention periods for applications, student records, answer scripts, research data, hostel records and alumni data?
23 Does the institution securely erase or destroy personal data, including answer scripts and paper files, when it is no longer required?
24 Can the institution implement and verify deletion across its systems, departments and Data Processors?
6. Data Security and Breach Management
25 Has the institution implemented appropriate technical and organisational security safeguards to protect personal data?
26 Is access to student, examination and staff records role-based, reviewed and logged?
27 Does the institution have documented procedures to detect, investigate, respond to and record personal data breaches?
28 Can the institution notify affected individuals and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, AI and Cross-Border Processing
29 Does the institution assess the data protection practices of vendors, such as the student information system, learning platform, proctoring and placement providers?
30 Do contracts with Data Processors include provisions for data protection, security, breach reporting and deletion?
31 Has the institution assessed the privacy risks of Artificial Intelligence (AI) tools used in admissions, teaching, assessment or student support?
32 Has the institution identified personal data processed outside India, for example by cloud services, foreign partner universities or international admissions agents, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are faculty, administrative staff, research staff and student assistants trained on their responsibilities under the DPDP Act?
34 Does the institution assess privacy risks before new systems, research projects or significant changes to processing, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the institution periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.