DPDPA Compliance for Schools in India: What Principals Need to Know

India's Digital Personal Data Protection Act, 2023 (DPDPA) came into effect with significant implications for any organisation that collects and processes personal data — including schools. This is not a regulation schools can ignore.

Here's a plain-language guide to what DPDPA means for your school and the steps you should take now.

What data does your school collect that falls under DPDPA?

Schools collect an unusually broad range of personal data:

Student data: name, date of birth, address, Aadhaar number, academic records, health information
Parent data: names, contact details, financial information (for fee collection), employment details (for scholarship verification)
Staff data: biometric attendance, payroll data, performance records
Behavioral data: attendance patterns, disciplinary records, counselling notes

Under DPDPA, all of this is "personal data" and requires a legal basis for processing. For most of it, the legal basis is consent — and schools are now required to document that consent.

Key obligations under DPDPA

1. Consent before collection

Schools must obtain explicit, specific, and informed consent before collecting personal data. A blanket admission form consent clause is not sufficient.

What this means practically:

Create separate consent forms for different purposes (admission, health records, WhatsApp communications)
Explain clearly what data is collected and why
Allow parents to withdraw consent (and define what happens to existing data)

2. Data localisation (§16)

Under §16 of DPDPA, significant personal data must be stored in India. This is directly relevant to your school ERP vendor — if your data is stored on servers outside India, you are non-compliant.

Ask your current vendor explicitly: Where is your data stored? Can they provide evidence of India-based storage?

Friensys runs on AWS Mumbai (ap-south-1). All customer data remains in India.

3. Purpose limitation

Data collected for one purpose cannot be used for another without fresh consent. If you collected a parent's mobile number for fee reminders, you cannot use it for marketing your new wing without separate consent.

4. Data retention and deletion

Schools must define how long they retain personal data and must delete it when it's no longer needed. You need a documented data retention schedule — including what happens to student records after graduation.

5. Data breach notification

In the event of a data breach, you must notify the Data Protection Board within a prescribed timeframe. You need an incident response plan before an incident happens.

What to do now

Step 1: Audit your data collection points. Map every place your school collects personal data — admission forms, fee receipts, attendance systems, health records, WhatsApp groups.

Step 2: Review your ERP vendor's data practices. Where is your data stored? What are their breach notification procedures? Do they offer a Data Processing Agreement?

Step 3: Update your consent processes. Revise your admission forms to collect specific, documented consent for each data use.

Step 4: Implement a data retention schedule. Define how long you keep records for current students, alumni, and staff who have left.

Step 5: Train your staff. DPDPA compliance requires organisational culture change, not just process change. Staff who handle student data need to understand why this matters.

How Friensys helps

Friensys provides:

Data hosted exclusively in AWS Mumbai (India data residency)
Data Processing Agreements available on request
Audit logs on every data access and modification
Consent management workflows (in development for 2026)

Read our security page for full details on our compliance posture, or contact us to request our DPA.