Data privacy for educational institutions
What the Digital Personal Data Protection Act, 2023 and the Rules, 2025 mean for schools, universities and trusts, and how to be ready.
The institution, not the vendor, is answerable.
Minors
Most students are under 18, which attracts the strictest duties.
Rich records
Identity, health, fee and disciplinary data sit in one file.
Many vendors
ERP, LMS, proctoring and payment providers hold data for the institution.
Long retention
Student, staff and alumni records are held for decades.
Three dates to plan around.
Rules notified. Rules 1, 2 and 17 to 21 in force, covering the Data Protection Board.
Rule 4 in force: registration of Consent Managers.
Rules 3, 5 to 16, 22 and 23 in force: notice, consent, safeguards, breach reporting, children, rights and cross border transfers. This is the main compliance date for institutions. days remain.
Eight duties every institution should be able to show.
A clear privacy notice
An itemised description of the data and each purpose in plain language, how to withdraw consent and exercise rights, how to complain to the Board, and a contact person. Keep the notice separate from the prospectus, fee terms and undertaking.
Valid consent or a legitimate use
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give.
Children's data
Verifiable consent of the parent or lawful guardian for anyone under 18. No tracking, behavioural monitoring or targeted advertising directed at children, except for educational activities or safety. No processing likely to harm a child's wellbeing.
Reasonable security safeguards
Encryption or masking, role based access for staff and vendors, logs kept for at least one year, backups, and security terms in every vendor contract.
Breach response
Inform each affected person without delay and report to the Board without delay, with a detailed report within 72 hours.
Rights of students and parents
Access, correction, erasure, withdrawal of consent, grievance redressal and nomination. For students under 18, the parent or guardian exercises every right.
Retention and erasure
Erase when consent is withdrawn or the purpose ends, unless another law, audit or grievance requires retention. Each institution should fix its own schedule by record type.
Vendor control
The institution stays responsible even in the event that a processor causes the failure. Processor agreements should control purpose, security, sub processors, breach notice and deletion.
Maximum penalties under the Schedule to the Act.
The Board decides after an inquiry, having regard to gravity, duration and mitigation. A voluntary undertaking can close proceedings.
| Default | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards | Rs. 250 crore |
| Failure to notify a breach to the Board and Data Principals | Rs. 200 crore |
| Breach of the obligations relating to children | Rs. 200 crore |
| Breach of the duties of a Significant Data Fiduciary | Rs. 150 crore |
| Any other breach of the Act or the Rules | Rs. 50 crore |
Map, document, operationalise.
Map
- Inventory data by department
- List vendors and data flows
- Flag children's data and risky uses
- Appoint a nodal officer
Document
- Notices and consent forms
- Retention and deletion schedule
- Processor agreements
- Breach response plan
Operationalise
- Train admissions, IT, hostel and HR teams
- Launch the grievance channel
- Run a mock breach drill
- Report to the governing body