DPDP Act for schools: student data and parent consent explained
Schools hold more children's data than almost anyone. What the DPDP Act and its rules say about children, where schools are exempt, and what to ask your software vendor. Not legal advice.
On this page
India's Digital Personal Data Protection Act, 2023 treats anyone under 18 as a child and normally requires verifiable consent from a parent before a child's personal data is processed. The rules notified in November 2025 exempt educational institutions from parts of these child-data duties when the processing is for educational activities and students' safety. Schools still have to collect only what they need, keep it secure, and handle data responsibly, and so does any software they use. This is an explainer, not legal advice: confirm your obligations with a lawyer.
Who this is for: principals, trustees and administrators choosing or reviewing school software. Who it isn't for: anyone needing a legal opinion on a specific case.
Cloudgramam makes Classveda, a school ERP, so we have an interest here. The checks below work for any product you compare.
What does the DPDP Act say about children?
The Act (No. 22 of 2023) defines a child as someone under 18. Under Section 9, a data fiduciary (the organisation deciding how data is used) must get verifiable consent from a parent or lawful guardian before processing a child's personal data, and must not track, monitor the behaviour of, or target advertising at children. The Act also requires reasonable security safeguards and, in the event of a breach, telling the Data Protection Board and the people affected.
Are schools exempt?
Partly. Section 9 allows exemptions, and the rules notified in November 2025 list educational institutions among the organisations exempt from the verifiable-consent and tracking restrictions, for processing limited to educational activities and the safety of students. Commentators differ on how far this reaches, especially for private education providers and apps, and parts of the rules phase in over time. MeitY publishes the Act and rules on its data protection framework page. Ask your lawyer how the exemption applies to your school and each activity.
What does this mean in practice?
| Area | What a careful school does |
|---|---|
| Collect less | Only the data needed for admission, teaching, fees and safety |
| Parent consent | Records consent for anything beyond educational activities and safety, such as photos used in marketing |
| Parent access | Links each parent only to their own child, through a check the school controls |
| Security | Role-based access, encryption, backups and a log of who changed what |
| Student messaging | No private student-to-student messaging inside school apps |
| Vendors | Knows where each vendor stores data and who can see it |
| Breaches | Has a plan for telling the Board and families if data leaks |
A worked example: the annual day photos
This example is made up. A school wants to post annual day photos on its website and Instagram.
- Taking photos for the school's records of the event may fall within educational activities.
- Posting identifiable children's photos publicly for promotion is a different purpose. The careful approach is to ask parents for consent first and record it against each child.
Your software should let you record that consent per child, and your marketing team should check it before posting.
What to ask your school software vendor
- Where is our data stored, and who at your company can see it?
- How are parents linked to their children, and can a parent see another child?
- What access controls and logs are there for staff?
- How is data encrypted and backed up?
- Can we record parent consent per child for specific purposes?
- How do we export or delete a student's data when they leave?
- Does the AI or analytics in the product profile students? How?
Software that runs on the school's own server, as Classveda does, keeps the database under the school's control, but the duties stay the same. For choosing software, see school ERP software in India, and for AI tools specifically, AI tutors for school students.
Frequently asked questions
Who counts as a child under the DPDP Act?
Anyone under 18.
Do schools need parent consent for everything?
The 2025 rules exempt educational institutions from the verifiable-consent requirement for processing limited to educational activities and student safety. Other uses, such as marketing, are a different matter. Confirm the details with your lawyer.
Does the Act apply to school software vendors?
Vendors usually process data on the school's behalf, so the school must make sure they protect it. Ask the questions above in writing.
Is this legal advice?
No. It's a plain-language explainer of the Act and rules as published, checked on 14 November 2026. Get legal advice for your school.
Want school software built with student data in mind? See Classveda.
