DPDP for schools

A school that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Admissions, attendance and marks, fee collection, parents of children under 18.

Where personal data sits

Admission desk (forms and the admission register)
School office phone
Student records app
Teacher phones used for parent groups

What Fohrkast maps

Student and parent names
Parent mobile number
Date of birth
Address
Details of students under 18
Marks and attendance
Bills and payment details
Photos from school events
Staff names, phone numbers and salary records

Each use of the data is recorded as a purpose:

Admission and classes. Admit the student, run classes and share progress with parents.
Fees and receipts. Collect fees and issue receipts.
Photos at school events. Share photos of school events on the school website.

Which duties weigh most

Children's data. A child is anyone under 18 (s.2(f)). Before using a child's personal data, a parent's verified consent is needed (s.9(1), Rule 10). Penalty up to ₹200 crore (s.33, Schedule item 3).
People who act through a guardian. For an adult with a disability who acts through a lawful guardian, the guardian's consent comes first, after checking the appointment (s.9(1), Rule 11).
Decisions and sharing. Data used to make a decision about a person, or shared with another Data Fiduciary, must be complete, accurate and consistent (s.8(3)).
Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).

Sector rules

The sector regulator's rules for a school: not set.

A short case

Case: not set. Figures: not set. Customers: not set.

When do the duties start?

Date	What starts	Gazette reference
13 Nov 2026	Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4).	G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3)
13 May 2027	Nearly every duty on businesses, and the Board's penalties.	G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4)

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

Privacy Check: a look at the website's notices, trackers and forms.
Plans and prices in INR.
Book a demo.

Not legal advice.