For Education

Schools, colleges and edtech

Protect student data without treating the school exemption as a blanket waiver. The rule depends on the processing, not just the name of your institution.

Educational only · not legal adviceLast updated: 1 November 2026Written and edited by Sandesh Kokate

Consent Manager rule

Scheduled — 13 November 2026; s.6(9), Rule 4. Registration is for firms that want to operate a Consent Manager. This date does not require an ordinary business to register.

Scheduled — core duties: 13 May 2027. Rule 1(4) starts Rules 3, 5–16, 22 and 23 eighteen months after publication. Rule 1(3) starts Rule 4 after one year.

Registration in practice remains unconfirmed. Our limited official-source check on 1 November 2026 did not establish the Board's current appointments or a working application process. Board status

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027. For Rule 4, the same publication-date distinction gives 13 versus 14 November 2026. We use 13 November for planning. Rule 1(3) and (4) measure from publication. See Methodology.

s.6(7)–(9); Rule 4; First Schedule — Act · Rules PDF page 25Rule 1 — commencement

Your role

If you decide why and how student or staff data is used, you are a Data Fiduciary (s.2(i)). A vendor acting for you may be a Data Processor (s.2(k)). A vendor with its own purposes may be a Fiduciary too.

Do by 13 May 2027 — Scheduled

Law references identify the duty. Suggested tools and proof are Good practice.

Parental consent where required
s.9(1)–(3); Rule 10 — Act · Rules PDF page 27
Check the parent under Rule 10. Do not treat admission as covered by the tracking exemption.
Proof to keep: Flow and parent-verification test
How to do it →
Notice on consent forms
s.5; Rule 3 — Act · Rules PDF page 24
Use a short standalone notice: data, purpose, withdrawal and complaint routes.
Proof to keep: Dated notice and form sample
How to do it →
List student-data vendors
s.8(1), (2); Rule 6(1)(f) — Act · Rules PDF page 26
Good practice: list each app, LMS and ERP; identify each vendor's actual role.
Proof to keep: Data map and vendor register
How to do it →
Remove child ad-tracking
s.9(4); Rule 12; Fourth Schedule — Act · Rules PDF page 36
Limit any monitoring exemption to education or enrolled-child safety; it does not permit targeted ads.
Proof to keep: App review and settings
How to do it →
Former-student retention
s.8(7), (8); Rule 8; Third Schedule — Act · Rules PDF page 27
Respect the one-year floor and any longer legal period before erasure.
Proof to keep: Retention schedule
How to do it →
Cover staff data
s.4(1); s.7 — Act
Employment-related processing may use s.7(i). Good practice: map each staff-data purpose.
Proof to keep: Staff data map
How to do it →
Processor contracts
s.8(1), (2); Rule 6(1)(f) — Act · Rules PDF page 26
Sign valid contracts with security clauses. Good practice: record instructions and sub-vendors.
Proof to keep: Signed contract and vendor register
How to do it →
Two-step breach plan
s.8(6); Rule 7(1), (2)(a), (b) — Act · Rules PDF page 26
Notify users and the Board without delay; fuller Board report within 72 hours of awareness. Ask in writing for an extension.
Proof to keep: Plan, templates and drill record
How to do it →

What schools are exempt from

Law — s.9(4); Rule 12(1); Fourth Schedule, Part A, item 3: an educational institution is exempt from ss.9(1) and 9(3) only for tracking and behavioural monitoring for its educational activities or the safety of enrolled children. Admissions, fees and results get no automatic exemption from this item. It does not permit targeted ads. Rule 12 does not lift the harm prohibition in s.9(2).

s.9(4); Rule 12; Fourth Schedule — Act · Rules PDF page 36

How to check a parent

Law — s.9(1); Rule 10(1): check that the person claiming to be a parent is an identifiable adult. Adult means 18 or older (Rule 10(2)(a)). Use reliable identity and age details already held (Rule 10(1)(a)), or voluntarily provided details, including an authorised entity's virtual token (Rule 10(1)(b)). Digital Locker is covered by the definition and illustrations; a tick-box alone does not perform this check. Rule 10 checks the parent, not a prescribed method for checking the child's age. Rule 11 requires due diligence on the lawful guardian's appointment for a person with disability who has such a guardian.

s.9(1)–(3); Rule 10 — Act · Rules PDF page 27s.9(1); Rule 11 — Act · Rules PDF page 28

Your client's exemption is not yours

Law — Rule 12; Fourth Schedule: Part A names classes of Data Fiduciary, not software vendors as such. A client's class exemption is not your own exemption. Part B instead follows limited purposes: email-only accounts (item 3), location for safety (4), keeping harmful content away (5), and confirming a user is not a child or doing Rule 10 checks (6). The Note defines an educational institution as an institution of learning, including vocational education. Whether a specific online platform fits needs assessment. Good practice: ask which exemption the client relies on, record its limits, and build a parental-consent flow where needed.

s.9(4); Rule 12; Fourth Schedule — Act · Rules PDF page 36

Delete, but not too early

Law — s.8(7), DPDP Act 2023; Rule 8(3), DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025): erase when consent is withdrawn or the purpose is no longer served, subject to legal retention. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from processing, for Seventh Schedule purposes. Then erase unless another law requires longer. The Fiduciary must ensure its Processor follows that floor (Rule 8, Illustration, Case 2).

Our reading: do not erase before the Rule 8(3) floor when applying s.8(7). The opened text does not resolve every overlap. Confirm this reading before relying on it.

Rule 8(1), Third Schedule: the three-year dormancy rule is only for e-commerce and social media firms with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh. Account access and specified virtual-token access are excluded. Count from the latest relevant contact, rights exercise or Rules commencement, whichever is latest. Warn at least 48 hours before erasure (Rule 8(2)).

Good practice: write the floor and any longer legal period into the contract and deletion schedule. Agree who retains the records, returns data and confirms erasure.

s.8(7), (8); Rule 8; Third Schedule — Act · Rules PDF page 27

Two steps to the Board

Law — s.8(6), DPDP Act 2023; Rule 7, DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025): on becoming aware of a breach, tell affected users without delay (Rule 7(1)). Give the Board an initial description without delay (Rule 7(2)(a)). Send the fuller Board report within 72 hours of awareness (Rule 7(2)(b)). The Board may allow longer on a written request.

Good practice for vendors: alert your client as soon as you become aware of a breach. Do not wait for confirmation or a full report. Put this alert duty in your contract. Rule 7 sets the Fiduciary's reporting duties, not a separate vendor clock.

s.8(6); Rule 7(1), (2)(a), (b) — Act · Rules PDF page 26

Check your readiness →

What applies to you

Law — s.2(f): a child is under 18. Law — s.9(1), Rule 10: verifiable parental consent is needed unless a relevant exemption applies. Section 9(3) restricts tracking and targeted ads. Rule 12 does not lift the s.9(2) harm prohibition.