What does the DPDP Act change for schools and coaching centres by 13 May 2027?

Quick answer: the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 (notified 13 Nov 2025) make every school and coaching centre a Data Fiduciary for the data of its students, parents and staff. Most duties start on 13 May 2027, although some firms count 12 May 2027, so plan to be ready by the first week of May. The heavy items are plain-language notices, verifiable parental consent for under-18s, security safeguards with logs kept for a year, a 72-hour detailed breach report and a grievance channel that answers within 90 days. Penalties can reach ₹250 crore for security failures. Confirm the details with your lawyer; this guide is a planning checklist.

Who is the Data Fiduciary in a school or coaching centre?

Your institute decides why and how student, parent and staff data is used, so it is the Data Fiduciary. Software vendors that only store or process data on your instructions are Data Processors (section 8(2) of the Act) and must work under a written contract. If a vendor uses your student list for its own marketing, its own classes or model training, it stops being a processor and becomes a fiduciary itself, and the education exemptions no longer cover that use. Ask every vendor, in writing, that it never does this. Our own position is on the No-Poach and Data Ownership Pledge page.

What are the key dates?

What is the DPDP readiness checklist for an institute?

1. Map your data. List what you hold (admission forms, Aadhaar copies, photos, health notes, fee records, attendance, marks, CCTV), where it sits (registers, WhatsApp groups, Excel, apps) and who can see it.
2. Write a notice. Standalone, plain language, itemised list of data and purposes, links to withdraw consent, exercise rights and complain to the Data Protection Board. Offer it in Hindi and English at least; any Eighth Schedule language on request.
3. Decide your consent route for children. Everyone under 18 is a child under the Act, so a parent or guardian must give verifiable consent unless an exemption applies. See the verifiable parental consent guide.
4. Tag each purpose as exempt or consent-required. Attendance, academic progress and safety are in the education exemption (Rule 12 and Fourth Schedule); photos for publicity, marketing and analytics beyond education need consent.
5. Secure the data. Encryption or masking, access control by role, monitoring for unauthorised access, backups, and logs kept for 1 year (Rule 6).
6. Prepare a breach plan. Tell affected people without delay and the Board without delay, with a detailed report within 72 hours (Rule 7). Name who decides, who writes and who calls.
7. Set retention and erasure rules. Erase data when the purpose is served or consent is withdrawn unless a law requires you to keep it (board records, RTE, tax and labour records). Keep logs and state-purpose data for at least a year (Rule 8).
8. Publish a grievance channel. Access, correction, erasure and nomination requests; reply within 90 days (Rule 14(3)). Show a contact in every app and notice.
9. Sign a contract with every processor. Instructions-only processing, sub-processor list, breach notice to you within hours, deletion or return at the end, audit rights.
10. Train staff and rehearse. Front-office staff, class teachers and accounts staff handle most personal data; a one-hour session twice a year costs far less than one incident.

Which school and coaching purposes need consent and which do not?

What about students who are 18 or older?

Adult students are not children under the Act. Droppers and government-exam aspirants at coaching centres are often adults, so the student is the primary contact and parent visibility is the student's consent to give or revoke. When a school student turns 18, consent that a parent gave stops being the right basis; build a reminder so you can collect it again from the student.

What are the penalties for getting it wrong?

• Up to ₹250 crore for failure to maintain reasonable security safeguards.
• Up to ₹200 crore for failing to notify a breach or breaching duties around children.
• Up to ₹50 crore for other breaches.

These are maximums set in the Schedule; the Board decides the actual amount. For a small school the practical risks are complaints from parents, loss of trust after an incident and a vendor that cannot show logs.

How do you run a 30-day DPDP preparation sprint?

Where does software help and where does it not?

Software can keep a consent ledger, version notices, enforce roles, keep audit logs and run retention schedules. It cannot decide your purposes or sign your notices. See the DPDP readiness page for what Acavya provides to help you meet these duties; we do not claim certification, because no DPDP certification exists.