Skin
Free gap analysis · Schools

DPDP Gap Analysis for Schools

Measure your school’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to pre-primary, primary and secondary schools, school chains and trusts, boarding schools and coaching centres for school students operating in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the school or its managing trust assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the school identified when it acts as a Data Fiduciary and when its vendors, such as the school management software or transport operator, act as Data Processors?
03 Are data protection responsibilities defined for the principal, teachers, class teachers, office staff, accounts, transport and IT?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Student Data Inventory and Mapping
05 Has the school identified the personal data it holds about students, parents, teachers, staff and visitors?
06 Has the school documented the purposes for processing personal data, including admissions, teaching, assessment, fees, transport, health, safety and communication?
07 Has the school mapped how student data flows between the school management system, learning apps, messaging groups, transport systems and boards?
08 Does the school maintain an inventory of systems, apps, devices and vendors that store or process personal data?
09 Has the school identified personal data shared with examination boards, government portals, transport operators, insurers and other recipients?
3. Notices and Consent
10 Does the school give parents a clear privacy notice explaining what personal data is processed about them and their child, why, and how to exercise their rights?
11 Has the school identified which processing relies on consent and which on a legitimate use or exemption under the DPDP Act and Rules?
12 Does the school obtain separate consent for optional uses such as photos on social media, newsletters, events and third-party programmes?
13 Can parents withdraw consent easily, and does the school act on it across classes, systems and vendors?
14 Are admission forms, the website, the parent app and messaging groups consistent in what they tell parents and collect?
4. Children’s Personal Data
15 Does the school obtain verifiable parental consent for processing students’ personal data where the DPDP Act and Rules require it?
16 Has the school checked that attendance tracking, CCTV, transport location tracking and monitoring of school devices stay within the exemptions for educational activities and safety?
17 Does the school make sure learning apps and vendors used with students do not show targeted advertising or track children for their own purposes?
18 Are sensitive records, such as health, counselling, special needs and disciplinary records, restricted to the staff who need them?
19 Does the school check that its processing, such as publishing results, rankings or photos, does not harm students’ well-being?
5. Rights and Retention
20 Can parents and students obtain a summary of their personal data, correct or update it, and request erasure where the law allows?
21 Does the school have a procedure for verifying, tracking and responding to parent requests and grievances?
22 Has the school defined how long it keeps admission records, assessments, report cards, photos, CCTV footage and data of students who have left?
23 Does the school securely erase or destroy personal data, including paper records, when it is no longer required?
24 Can the school confirm deletion of student data by its software providers and other Data Processors when a contract ends or a student leaves?
6. Data Security and Breach Management
25 Has the school implemented appropriate technical and organisational security safeguards to protect personal data?
26 Do staff use individual accounts with strong passwords, and is access to the school management system limited by role?
27 Does the school have a procedure to detect, investigate, respond to and record personal data breaches?
28 Can the school notify affected parents and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, Apps and Technology
29 Does the school assess the data protection practices of vendors such as the school management software, learning apps, transport and photography providers?
30 Do contracts with Data Processors include provisions for data protection, security, breach reporting and deletion?
31 Has the school assessed the privacy risks of Artificial Intelligence (AI) tools, proctoring, facial recognition or biometric attendance before using them?
32 Has the school identified student data stored or processed outside India by its apps and vendors, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are teachers, office staff, transport staff and volunteers trained on handling student and parent data?
34 Does the school assess privacy risks before introducing new apps, systems, CCTV or tracking, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the school periodically review its data protection practices, track corrective actions and keep evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.