What must a school or coaching centre do before 13 May 2027 under DPDP?

What starts on which date?

Who is responsible for what?

• Your institute is the data fiduciary for its students, parents and staff. It decides why and how the data is used and carries the main duties.
• Acavya is the data processor (section 8(2)). We process data only on your instructions under a data processing agreement.
• Acavya is also a fiduciary in its own right for institute owners’ and staff accounts, billing, and the global login identity and family link, which no single institute controls. We publish our own privacy notice for those.

What does parental consent require for children?

A child is anyone under 18. Before processing a child’s data, a fiduciary needs verifiable consent from a parent or guardian (section 9(1), Rule 10): the consenting person must be an identifiable adult, which can be checked from identity and age details the institute already holds or through a government token route. Record which route you used. When a student turns 18, consent should be collected again from the student.

Adult students are not children under the Act. Coaching droppers and government-exam aspirants are often adults, so the student is the primary contact and parent visibility is the student’s choice.

Do schools get an exemption?

Partly. Rule 12 and the Fourth Schedule exempt educational institutions from parental consent and the tracking and monitoring ban only for tracking or monitoring for educational activities or the safety of children, and transport providers only for location tracking during travel. Photos for publicity, marketing, analytics beyond education and similar uses still need consent. Whether coaching centres count as educational institutions is untested, so Acavya defaults to consent for anything beyond core education and safety in coaching tenants.

What are the rules for children’s data and advertising?

No targeted advertising, no tracking for advertising and no profiling for marketing for children. Processing likely to harm a child is not allowed and has no exemption. Acavya carries no ad or third-party analytics SDKs in student or parent apps, and this website uses no trackers either.

What security and breach duties apply?

• Security safeguards (Rule 6): encryption or masking, access control, logging and monitoring, backups, and keeping relevant logs for one year.
• Breach (Rule 7): tell affected people without delay, and tell the Data Protection Board without delay with a detailed report within 72 hours.
• Processor to fiduciary: a processor must tell the institute quickly. Our DPA aims for within 6 hours, in line with the CERT-In 6-hour reporting rule that we follow.

What about retention, rights and grievances?

• Erase data when the purpose is served or consent is withdrawn, unless a law requires you to keep it (section 8(7), Rule 8). Board records, RTE, tax and labour records have their own retention.
• People can ask to access, correct or erase their data and to nominate someone. You need a grievance channel and must respond within 90 days (Rule 14(3)).
• Penalties under the Schedule go up to ₹250 crore for security failures, ₹200 crore for breach notice and children’s obligations and ₹50 crore for others.

How does Acavya help?

• Standalone, versioned notices in English and Hindi, with re-notification when they change.
• Consent capture at admission, parental-consent verification (OTP plus identity confirmation), withdrawal that propagates, and an alert when a student turns 18.
• A per-student data export for access requests, a rights-request tracker, a breach console, and a retention scheduler with legal holds.
• A purpose tag on every kind of processing, so consent-free purposes (attendance, academic progress, safety) are separated from consent-required ones.
• A data processing agreement and sub-processor list.

Availability: consent capture, notices, the audit trail, single-student exports and the full compliance centre are available now. Our own data processing agreement and sub-processor list are published.

What should my institute do now?