DPDP Act 2023: What It Means for School Data

The Digital Personal Data Protection Act, 2023 is India’s general law on handling digital personal data. The Government has notified rules under it, and its duties are being brought into force in phases, so check the current commencement dates and the text of the rules, or ask a lawyer, before you rely on any summary. This article is general information, not legal advice.

The Act uses a few terms that map neatly onto a school. The school is a “Data Fiduciary”, the party that decides why and how personal data is processed. A student or parent is a “Data Principal”, the person the data is about. A software vendor or an SMS provider that handles data for you is a “Data Processor”. A “child” under the Act means someone under 18, which covers every student in a school.

Before any policy, list the data. Most schools discover they hold more than they thought.

For each row, note why you collect it, who can see it, where it is stored, how long you keep it and who you share it with. That page is the backbone of everything else.

The Act treats children’s data with extra care. In broad terms, processing a child’s personal data needs the verifiable consent of a parent or lawful guardian, and the law restricts tracking or behavioural monitoring of children and advertising directed at them. The rules provide for certain exemptions that can cover educational institutions for specified purposes, such as activities connected with education and safety. Read the exact wording in the rules for what your school may do without separate consent.

A practical approach is to put a clear privacy notice into the admission process, in plain language and, where needed, a local language. It should say what data you collect, for what purposes, who it is shared with (for example the board, the education department, your software vendor), how long you will keep it and how to contact you with questions. For uses beyond what the school needs to run (such as photos for marketing), ask for separate, specific consent and make it easy to withdraw.

Photographs and videos

Annual day photographs on the school website, or student images in an advertisement, need thought. A general “consent for photographs” tick box buried in an admission form is a weak basis. Use a separate consent for marketing use, and do not name children alongside images unless a parent agreed.

1. Give notice. Tell people what you collect and why, at the time you collect it.
2. Use data only for stated purposes. Fee phone numbers should not become a marketing list for a coaching centre.
3. Keep it accurate. Provide a way to correct records.
4. Secure it. Put reasonable safeguards in place: access control, strong passwords, backups, encryption in transit, limited exports. The Act places heavy penalties on failure to take reasonable security safeguards.
5. Delete it when the purpose ends. Decide retention periods, for example how long you keep enquiry records for families who did not join.
6. Respond to requests. Parents may ask to see, correct or erase data. Name a person and a route for these, and note replies and dates.
7. Report breaches. Have a plan for a lost device, a leaked spreadsheet or a hacked account, including who informs the authority and the affected families, as the rules require.
8. Control your vendors. Put data-handling terms into contracts and ask where the data lives.

Schools that go through one or two of these steps each month will be in a better position than those who try everything in a rushed week before a deadline.

• Spreadsheets on personal phones and WhatsApp. Student lists forwarded between staff are the most frequent leak. Prefer role-based access in your school system and restrict exports.
• Shared logins. When ten people use the accountant’s password, nobody is accountable. Give each user their own account.
• Over-wide access. A class teacher does not need to see fee arrears for the whole school.
• Old data that is never deleted. Enquiry sheets, former-staff files and old CCTV copies pile up.
• Public notice boards. Defaulter lists, rank lists with names and health lists on display create exposure.
• Unvetted apps. Teachers installing free tools and uploading student data.

Most of these are fixed by habit and by choosing software that assigns permissions properly. See the questions in buying school ERP, which include the data-storage and access questions to put to any vendor.

Your ERP is a data processor and a major part of your compliance. Ask for role-based access, an audit trail of who viewed or changed records, encrypted connections, tested backups, a method to export or erase one student’s data on request, and clarity on where servers are located. Read our security and privacy page as an example of the kind of statement you should expect.

Takshiva includes tools aimed at this work: a register of consents, a log of requests from data principals, a place to record breaches and designate a data protection contact, and per-student data export and erase actions. They help you keep records; they do not make the school compliant on their own, because the decisions and the policies are the school’s.

In the first month, build the data inventory and appoint a person to own privacy queries. In the second, publish the privacy notice, update admission and photograph consents, and review who has access to what. In the third, add vendor terms, set retention periods, write a one-page breach plan, and brief all staff for thirty minutes. Review the plan every year and after any incident.

Policies fail at the desk, not in the file. A short session for all staff, repeated each year for new joiners, covers the habits that prevent most incidents: do not forward student lists on WhatsApp, lock your screen, use your own login, share information only with people who need it, and report a mistake at once rather than hiding it.

Give staff a way to report. A named person, a phone extension and a simple form are enough. Praise early reporting, even when the cause was a slip; a school that punishes honest mistakes will learn about its breaches from parents instead.