DPDP Act 2023 for Schools: Is Your Current ERP Putting You at Legal Risk?

Under India's Digital Personal Data Protection (DPDP) Act 2023, educational institutions are no longer treated as casual administrators. Because schools collect, store, and process the personal information of children (minors under 18), the law holds school trusts to the highest standard of accountability.

Section 9 of the DPDP Act sets additional obligations for children's data, and the Schedule attaches penalties of up to ₹200 crore for breaching them — up to ₹250 crore for failing to take reasonable security safeguards. Two things matter about those numbers before you read any further.

First, the duties are not in force yet. The Act was assented on 11 August 2023 but did not commence then. The Central Government notified commencement by G.S.R. 843(E) on 13 November 2025, in three phases. Sections 3 to 17 — every substantive duty of a Data Fiduciary, including Section 8 security safeguards and Section 9 children's obligations — together with Sections 28 to 34, the entire inquiry and penalty chapter, come into force eighteen months from that publication, which falls around May 2027. Anyone telling your school it is in breach today, or that fines are being levied, is not describing the commencement notification.

Second, those figures are ceilings, not tariffs. Every Schedule entry reads "may extend to". Section 33(1) permits a penalty only where the Data Protection Board, on concluding an inquiry, determines the non-compliance is significant, and only after an opportunity of being heard.

So you have time. Use it to prepare rather than to panic — and read our sourced guide to the DPDP Act for schools, where every statement links the statute or the notified rules.

Yet, if you inspect the day-to-day IT practices of private schools in India:

• Student lists with Aadhaar numbers and parent phone numbers are emailed in plaintext Excel files.
• Front-office computers share a single administrator login password taped to a monitor.
• Old ERPs store sensitive health and fee payment histories in unencrypted local databases.

Here is what the DPDP Act will require of schools when it bites, what it specifically exempts schools from, and what to look for in software now.

1. The 4 Strict Mandates for Children's Data (Section 9)

The DPDP Act treats children's data with special protection, and your school is a Data Fiduciary by definition — there is no registration step, no minimum student count and no sectoral trigger. A child is anyone under eighteen, so a Class XII student of seventeen is covered.

Four rules will apply, and one of them has an exemption for schools that most vendor articles never mention.

A. Verifiable Parental Consent (VPC)

Schools cannot collect or process any personal data of a student without verifiable consent from the parent or lawful guardian. What this means in practice: A generic signature on a physical paper admission form is no longer sufficient for digital platforms. If your school uses an app that tracks a student’s bus location or academic grades, the digital platform must maintain an auditable record of parental consent.

B. No Detrimental Processing (Section 9(2))

Section 9(2) forbids processing that is likely to have a detrimental effect on a child's wellbeing. Leaking student home addresses or transport routes through weak software security sits squarely here. Note this one carefully: the educational-institution exemption described below does not touch Section 9(2). It applies to your school in full.

C. Tracking and Targeted Advertising (Section 9(3)) — and the schools exemption

Section 9(3) prohibits tracking, behavioural monitoring of children, and targeted advertising directed at them.

But schools are exempted from it. The DPDP Rules 2025 carry a Fourth Schedule, and Part A entry 3 disapplies both Section 9(1) and Section 9(3) for an "educational institution" — defined broadly as "an institution of learning that imparts education, including vocational education", not limited to recognised bodies. A separate entry 5 covers a provider engaged to transport enrolled children.

Read the condition column, because the relief is purpose-bound rather than institution-wide: it applies where processing is restricted to tracking and behavioural monitoring for the institution's educational activities, or in the interests of the safety of enrolled children. Attendance patterns and bus tracking for pupil safety are the intended cases. Repurposing the same data for something commercial is not.

The real risk here is your vendor, not your register. Some "free" edtech products monetise student data. The exemption covers an educational institution processing for educational activities and safety; it is not a shield for a third party's commercial use of the same records. Ask any vendor, in writing, what they do with your students' data.

D. Purpose Limitation & Right to Erasure (and who exercises it)

Data collected for school admissions cannot be repurposed for external commercial ventures, and when a student leaves, the school needs a defined retention and secure archival policy.

One practical point schools miss: where the Data Principal is a child, Section 2(j)(i) provides that "Data Principal" includes the parent or lawful guardian. So access, correction, erasure and grievance requests will come from parents, about their own child's records, and your office needs a way to answer them.

2. Practices That Will Not Survive Section 8

3. The Technical Checklist: What to Look For in Software

No product makes a school compliant — compliance covers your policies, notices, retention, contracts with other processors and how your staff behave, and it stays your institution's obligation. What software can do is make the duties dischargeable, and one provision explains why that matters more than it sounds.

Section 6(10) puts the burden of proof on the Data Fiduciary: in any proceeding where consent is in question, the school must prove both that notice was given and that consent was properly obtained. That is an evidence problem, and evidence is exactly what a system keeps and a paper file does not.

Five things to look for:

1. Row-Level Security (RLS) & Scope-Isolated Access

A class teacher in Grade 4 should only see Grade 4 attendance and marks. They should have zero visibility into:

• The school’s overall fee collection ledgers.
• Parent financial income brackets.
• Students in Grade 10. Every user role (Principal, Teacher, Accountant, Transport Coordinator, Librarian) must have strictly sandboxed, role-scoped tokens.

2. Encryption at Rest and in Transit

• At Rest: All stored databases (student master, fee records, contact details) must be encrypted using industry-standard AES-256 encryption.
• In Transit: Every connection between a computer, mobile app, and server must use TLS 1.3 cryptographic protocols.

3. Immutable Audit Trails

If a fee waiver is approved, a grade is altered, or a student's contact number is modified, the system must write an immutable log:

• Who changed it? (User ID)
• What was the previous value?
• What is the new value?
• Exact timestamp & IP address. These audit logs must be append-only and tamper-proof.

4. Scoped & Recorded Support Sessions

When software support is required, external engineers must never be granted unmonitored desktop access. Modern platforms feature built-in, scoped support sessions where every action performed by an engineer is recorded, time-limited, and visible to the school administrator.

4. How B2skool Ensures Complete Legal Protection

At B2skool, our architecture was built post-DPDP Act, designed from the ground up to protect educational institutions:

• Local Data Sovereignty: The free desktop system operates on an encrypted local database inside your school premises. Your records do not sit on vulnerable public cloud servers unless you choose cloud sync.
• Strict Role-Based Permissions: Pre-configured roles ensure teachers, clerks, and parents access strictly the data they are authorized to see.
• No Shared Passwords: Individual staff credentials with optional multi-factor authentication.
• Cryptographic Audit Logs: Every change to fees, marks, and student profiles is permanently logged.
• Zero Third-Party Data Monetization: B2skool never sells, analyzes, or shares student data with advertisers or coaching institutes.

Action Plan for School Boards

1. Conduct an IT Audit: Identify where student Aadhaar numbers, health notes, and parent bank details are currently stored.
2. Eliminate Shared Credentials: Create individual accounts for every clerk and teacher immediately.
3. Review Vendor Contracts: Demand a signed Data Processing Agreement (DPA) affirming compliance with Section 9 of the DPDP Act 2023.

Is your school data secure under the new law?
Read our full B2skool Security & Privacy Architecture or request a private compliance audit for your school trust.