Key points
- Students under 18 are children under the DPDP Act; verifiable parental consent is required.
- The Rules relax children's data restrictions for educational institutions only for educational activities and student safety.
- Crèches and school transport providers have a safety-only exemption, including location tracking.
- ERP, LMS and exam vendors are Data Processors and need DPDP contracts.
- Sharing student data with recruiters needs a stated purpose and consent.
Why education needs special attention
Most school students and many first-year college students are under 18, so they are children under the DPDP Act. Institutions also share data with ERP, LMS, exam, transport, hostel and placement partners. That makes children's data, vendor contracts and notices the three biggest areas to fix.
Where personal data sits in an institution
| Where the data is | Examples | DPDP point to watch |
|---|---|---|
| Admissions and enquiries | Applications, marks, ID proof, parents' income | Notice and consent (Section 5, 6) |
| Students under 18 | School and first-year college students | Verifiable parental consent (Section 9, Rule 10) |
| Academic records and exams | Attendance, marks, transcripts | Accuracy when used for decisions (Section 8(3)) |
| ERP, LMS and online exam tools | Logins, submissions, proctoring video | Vendor contracts (Section 8(2)) |
| Hostel, transport and CCTV | Room allotment, bus GPS, video | Retention, limited exemptions for safety |
| Health centre and counselling | Medical and counselling notes | Strict access control (Rule 6) |
| Placements | CVs and contact details shared with recruiters | Consent before sharing |
| Alumni and fundraising | Contact details, employment | Erasure on request (Section 12) |
Children's data and the education exemptions
Before processing a child's personal data, you need verifiable consent from a parent or lawful guardian, and you may not track, behaviourally monitor or target advertising at children (Section 9). The DPDP Rules relax these restrictions for educational institutions to the extent needed for educational activities and for the safety of enrolled children, and for crèches and school transport providers for safety and location tracking. They do not cover marketing, selling data, or sharing with third parties for other purposes.
Vendors: ERP, LMS and edtech
Most institutions rely on cloud ERPs, LMS platforms, online exam and proctoring tools, and payment gateways. Each one is a Data Processor and needs a written contract covering processing only on your instructions, security safeguards, breach notification, erasure at the end of the contract, and no use of student data for the vendor's own purposes.
Placements and alumni
Sharing student CVs with recruiters needs a clear purpose in the notice and the student's consent. Alumni databases should have a retention period and an easy way for alumni to update or erase their details.
10 steps for institutions
- Appoint a data protection lead and publish a contact on the website.
- Approve an IT and data protection policy through your governing body.
- Map data across admissions, academics, hostel, transport, health centre and placements.
- Add notices to admission forms, in English and the regional language.
- Set up verifiable parental consent for students under 18.
- Review ERP, LMS and exam vendor contracts for DPDP clauses.
- Restrict and log access to marks, health and counselling records.
- Set retention periods for applications, CCTV, alumni and exam data.
- Create a rights and grievance desk with a published response time.
- Train deans, heads of department, faculty and office staff.
Want to know where your organisation stands? Take the free 40-question DPDP Readiness Check, or see our full DPDP compliance checklist.
Frequently asked questions
Are schools exempt from the DPDP Act?
No. Schools and colleges are Data Fiduciaries. The DPDP Rules only relax the children's parental-consent and tracking restrictions to the extent needed for educational activities and for the safety of enrolled children.
Do colleges need parental consent for first-year students under 18?
Yes, for processing that falls outside the educational and safety exemption. Students under 18 are children under the Act, so verifiable consent from a parent or guardian is needed.
Is CCTV in schools allowed under DPDP?
Monitoring for the safety of enrolled children falls within the education exemption, but you still need notice, access control and a defined retention period for footage.
Can a college share student data with recruiters?
Only for a purpose stated in the notice and with the student's consent. Share only what the recruiter needs.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.