The key points
- The Act treats everyone under 18 as a child, so almost every school record is a child's data.
- The Rules give limited exemptions for purposes such as education, not a blanket exemption.
- Photos, marketing and any behavioural tracking need separate care.
- Schools remain responsible when a software vendor handles the data for them.
What does the DPDP Act say about children's data?
The Digital Personal Data Protection Act, 2023 defines a child as anyone under 18. A data fiduciary, which includes a school deciding why and how student data is used, must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data. The Act also bars tracking, behavioural monitoring and targeted advertising aimed at children.
The DPDP Rules, 2025 were notified in November 2025 with an eighteen-month phased timeline. According to the Press Information Bureau, they provide limited exemptions for essential purposes such as healthcare and education. Those exemptions are narrow and conditional, so a school should not treat them as permission to use student data for anything it likes.
What should a school do in practice?
Start by listing what you collect and why. Admission forms, attendance, marks, health notes, photographs and fee records each have a purpose, and anything without one should stop being collected. Keep sensitive items such as health information and identity documents behind tighter access than general records.
Issue a clear notice to parents explaining what you collect and for which purpose, and keep a record of consent where it is needed, for example for photographs on social media or for marketing messages. Set retention periods so records of former students are not kept forever without reason, and give parents a simple way to ask for corrections.
- Collect only what a stated purpose needs
- Restrict access by role and keep an audit trail
- Get separate consent for photographs, promotion and optional services
- Set a retention period and delete or archive records after it
- Name a person who handles parent requests and complaints
What about vendors, apps and breaches?
When a school uses management software, a messaging provider or a payment gateway, those vendors process student data on its behalf. The school stays responsible, so it should have a written agreement covering security, purpose, sub-processors and what happens to the data when the contract ends. The same applies to any AI features added to a product that send student information to an outside service.
The Rules also require data fiduciaries to inform affected people in plain language if a personal data breach occurs, explaining what happened and what is being done. Decide in advance who investigates, who contacts parents and how. For general website obligations, see what the DPDP Act means for a business website, and for the software side, what school management software should include.
Where should you get legal advice?
This page explains the main ideas and is not legal advice. The exemptions, the timeline and the technical requirements for verifying parental consent depend on the exact wording of the Act and Rules, and guidance is still developing. Ask a lawyer familiar with the DPDP Act to review your consent forms and vendor contracts before the compliance dates apply to you.
DPDP preparation for a school
- A list of the student data you collect, with the purpose for each item
- A parent notice that explains purposes in plain language
- Separate consent for photographs, promotion and optional services
- Role-based access and an audit trail in your school software
- Written agreements with every vendor that handles student data
- A named person and a plan for parent requests and breach notices
Sources
Rules and guidance this answer relies on. Policies change, so check the current version before acting on it.