Growth Hub for Opportunities, Skills, Learning & AchievementGrow•Learn•AchieveUnder the DPDP Act 2023, schools and colleges must give a clear notice, take verifiable parent consent for students under 18, limit staff access, keep activity logs, let families access, correct and erase data, retain data only as long as needed and name a contact for data complaints.
- Schools are Data Fiduciaries under the Act
- Parent consent is needed for students under 18
- No tracking or targeted ads aimed at children
- Role-based access, logs and erasure requests
- Check the latest official rules and timelines
What the law is
The Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how organisations in India collect and use personal data. A school, college or coaching institute that decides why and how student data is used is a “Data Fiduciary” under the Act.
Why education is special
Most school students are under 18. For children’s data the Act asks for verifiable consent from a parent or guardian, and it bars tracking, behavioural monitoring and targeted advertising aimed at children.
A practical checklist
- Tell parents clearly what data you collect and why (a notice)
- Take parent / guardian consent at admission and keep a record of it
- Give staff access only to the data their role needs
- Keep an activity log of who changed what
- Let parents and students see, correct and ask to erase their data
- Keep data only as long as you need it, then delete it safely
- Have a named contact for data questions and complaints
How software helps
A good ERP captures consent at admission, enforces role-based access, logs every change and handles access and erasure requests — so compliance becomes part of daily work instead of a yearly scramble.
Check the latest rules
The DPDP Rules and their timelines are notified by the Government of India. Always check the latest official notifications, and take legal advice for your institution.
Frequently asked questions
Does the DPDP Act apply to schools?
Who counts as a child under the Act?
What is the penalty for not complying?
Is Ghosla ERP DPDP ready?
Have a question? Talk to the Ghosla team or ask Ghosla AI.