The DPDP Act 2023, and what it actually asks of a school

Your school is in scope, and there is no size threshold

The Act defines a Data Fiduciary functionally — by who decides the purpose and the means of processing. There is no registration step, no minimum student count and no sectoral trigger. A school that decides why and how student, parent and staff data is handled is a Data Fiduciary on its own facts. The Act’s definition of "person" covers every legal form an Indian school takes: a company, a society, a trust, an association of persons, the State. A 300-student trust-run school is as much in scope as a 4,000-student chain.

Every one of your students is a child

Section 2(f) defines a child as anyone who has not completed eighteen years. There is no lower tier — no separate treatment at 13 or 16 as some other regimes have. A Class XII student of seventeen is a child for this Act. And where the Data Principal is a child, section 2(j)(i) provides that "Data Principal" includes the parent or lawful guardian, so the rights of access, correction, erasure and grievance redressal are exercisable by parents over their own child’s records.

The duties do not bind you yet. They land in 2027

This is the part a vendor selling on urgency will not tell you. The Act received assent on 11 August 2023 but did not commence then: section 1(2) left commencement to notification. The Central Government notified it by G.S.R. 843(E) on 13 November 2025, in three phases measured from that publication date.

• Phase 1, on publication: definitions, the constitution of the Data Protection Board, and rule-making powers. Not the obligations on data handlers.
• Phase 2, one year on: the Consent Manager provisions only.
• Phase 3, eighteen months on — around May 2027: sections 3 to 17, which is every substantive duty of a Data Fiduciary, together with sections 28 to 34, the entire inquiry and penalty chapter.
• So today, section 8 (security safeguards and breach notification), section 9 (children’s data) and section 33 (monetary penalties) all sit inside that deferred block.

The exemption for educational institutions, and its edges

The DPDP Rules 2025 carry a Fourth Schedule, and Part A entry 3 exempts an "educational institution" from the section 9(1) verifiable-parental-consent duty and the section 9(3) tracking prohibition. That is a genuine relief, and the definition is broad — "an institution of learning that imparts education, including vocational education", not limited to recognised bodies. But read the condition column: it applies where processing is restricted to tracking and behavioural monitoring for the institution’s educational activities, or in the interests of the safety of enrolled children. It is an exemption for a purpose, not a blanket pass for everything a school does with a student’s data. A separate entry 5 covers a provider engaged to transport enrolled children, restricted to tracking location for their safety. Both sit in the deferred block and are not in force yet either.

The penalties are ceilings reached after an inquiry, not automatic fines

The Schedule to the Act sets maximum penalties — up to ₹250 crore for failing to take reasonable security safeguards against a breach, up to ₹200 crore for failing to notify one, and up to ₹200 crore for breaching the children’s obligations. Every entry reads "may extend to". Section 33(1) permits a penalty only where the Board, on concluding an inquiry, determines the non-compliance is significant, and only after an opportunity of being heard. Section 33(2) then requires it to weigh the nature, gravity and duration of the breach, what was mitigated, and proportionality. Plan for these duties seriously. Do not be frightened into a purchase by a number quoted without that context.

Where software helps, and where it does not

Compliance is the school’s obligation and no product confers it. What software can do is make the obligations dischargeable. Section 6(10) puts the burden of proof on the Data Fiduciary: in any proceeding where consent is in question, the school must prove both that notice was given and that consent was obtained properly. That is an evidence problem, and evidence is what a system keeps and a paper file does not.

• Consent and notice recorded against the record, with when and by whom, so the section 6(10) burden can be met
• Row-level security per school, so a record cannot be reached from outside the institution that owns it
• Role scoping, so a teacher reaches their own classrooms and a parent only their own ward
• An audit ledger of every change, which is what an inquiry will ask to see
• Export and erasure that can actually be executed when a parent exercises a right