DPDP Act 2023
The Digital Personal Data Protection Act, 2023 (the DPDP Act) governs how any organisation collects, uses, stores, shares and deletes the digital personal data of people in India. The DPDP Rules, 2025 were notified on 13 November 2025 and fill in the detail: what a notice must say, how to get a parent's verifiable consent, what counts as reasonable security, how fast a breach must be reported and how long logs must be kept.
The law is being switched on in three steps. The Data Protection Board and the definitions are already in force. Consent Managers can register from 13 November 2026. Almost everything an institution must actually do, from notices and consent to security, breach reporting, children's data and penalties, applies from 13 May 2027.
For a university, college or school group this is not a back-office matter. Admissions, fees, scholarships, hostels, exams, proctoring, placements, alumni and parent communication all run on personal data, and a large share of first-year students and almost every school student is legally a child (under 18). The 18-month runway is the time to fix this properly, not a reason to wait.
Any institution that decides why and how student, parent, staff, applicant or alumni data is processed is a Data Fiduciary under Section 2(i). This covers central, state, deemed and private universities, autonomous and affiliated colleges, and school groups, whether run by a government, a trust, a society or a company. The Act covers digital personal data, and paper records once they are digitised.
A child is anyone who has not completed 18 years (Section 2(f)). That includes almost all school students and many first-year undergraduates. Before processing a child's personal data, the institution must obtain the verifiable consent of a parent or lawful guardian (Section 9(1), Rule 10), unless a Fourth Schedule exemption applies. For a child, "Data Principal" includes the parent (Section 2(j)).
Where a person with disability has a lawful guardian, consent comes from that guardian, and the institution must check that the guardian was appointed by a court, a designated authority or a local level committee (Section 9(1), Rule 11).
A vendor that processes data on behalf of an institution is a Data Processor (Section 2(k)) and may be engaged only under a valid contract (Section 8(2)). The institution stays responsible for what its processors do (Section 8(1)). A vendor that uses student data for its own purposes, such as its own marketing or model training, is acting as a Data Fiduciary for that purpose and carries the full duties itself.
Processing by the State or its instrumentalities to provide a subsidy, benefit, service, certificate, licence or permit can rely on the legitimate use in Section 7(b), following the standards in the Second Schedule (Rule 5). Scholarships, fee reimbursement and certificate issue by state bodies are the usual examples. The other duties, such as security and breach intimation, still apply.
The Central Government can notify any Data Fiduciary, or class of them, as a Significant Data Fiduciary based on volume and sensitivity of data and risk (Section 10). SDFs must appoint an India-based Data Protection Officer, appoint an independent data auditor, and run a yearly Data Protection Impact Assessment and audit (Rule 13). This page does not state whether any education body has been notified. Check the latest notification under Section 10.
The Act also applies to processing outside India if it is connected to offering goods or services to people in India (Section 3(b)). Foreign universities recruiting Indian students and offshore edtech platforms are in scope.
Process personal data only with the person's consent or for a listed legitimate use (Section 4). For most institutional processing the basis will be consent. The legitimate uses in Section 7 are narrow, so do not assume "we are an educational institution" is a basis on its own.
DPDP Act, Sections 4 and 7
Every consent request must come with a notice that stands on its own, in clear and plain language, with an itemised description of the data, the specific purpose, and a link explaining how to withdraw consent, exercise rights and complain to the Board. The notice must be available in English or any language in the Eighth Schedule to the Constitution on request.
DPDP Act, Section 5; Rule 3
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. Withdrawing must be as easy as giving consent. Bundled "agree to everything" admission forms will not meet this standard.
DPDP Act, Section 6
Before processing a child's data, take technical and organisational measures to obtain the verifiable consent of a parent, and check that the person consenting is an identifiable adult. The check can use identity and age details the institution already reliably holds, or details or a virtual token issued by an authorised entity, including through DigiLocker.
DPDP Act, Section 9(1); Rule 10
Do not process a child's data in a way likely to harm the child's well-being, and do not track, behaviourally monitor or target advertising at children. The Fourth Schedule lets educational institutions track and behaviourally monitor children without parental consent, but only for their educational activities or for the safety of enrolled children (see the FAQs). The ban on harmful processing has no such exemption.
DPDP Act, Sections 9(2), 9(3) and 9(4); Rule 12; Fourth Schedule
At a minimum: encryption, masking, obfuscation or tokenisation; access control over systems; logs, monitoring and review to detect and investigate unauthorised access; backups and continuity measures; contract clauses binding your processors to the same safeguards; and technical and organisational measures to make all of this real.
DPDP Act, Section 8(5); Rule 6(1)
Keep the personal data, associated traffic data and logs of each processing activity for at least one year from the date of processing, including logs held by your processors, and then erase them unless another law requires longer. This is separate from, and longer than, the 180-day log rule in the CERT-In Directions.
Rule 6(1)(e); Rule 8(3); Seventh Schedule
On becoming aware of a breach, tell each affected person without delay, in plain language, what happened, the likely consequences, what you are doing and what they can do. Tell the Board without delay, then send a detailed report within 72 hours covering the facts, cause, mitigation, any findings on who caused it, steps to prevent recurrence, and the intimations given to affected people. There is no materiality threshold.
DPDP Act, Section 8(6); Rule 7
Keep data complete, accurate and consistent where it is used for decisions about a person, such as admissions, results or scholarships. Erase data, and make your processors erase it, once consent is withdrawn or the purpose is served, unless a law requires you to keep it. Degree, mark-sheet and statutory records you must keep by law stay; everything else needs a retention schedule.
DPDP Act, Sections 8(3), 8(7) and 8(8); Rule 8
Publish prominently on your website or app the business contact details of your Data Protection Officer, if you have one, or of a person who can answer questions about processing, and repeat them in every response to a rights request. Run a grievance mechanism and publish the time within which you will respond, which must not exceed 90 days.
DPDP Act, Sections 8(9), 8(10) and 13; Rules 9 and 14
People can ask for a summary of their data and processing, and who it was shared with; correction, completion, updating and erasure; grievance redressal; and to nominate someone to act for them on death or incapacity. Publish how to make a request and what identifier, such as an enrolment ID, you need.
DPDP Act, Sections 11 to 14; Rule 14
People will be able to give, manage and withdraw consent through a Consent Manager registered with the Board. Registration opens from 13 November 2026. Institutions should design their consent flows so that they can accept consent through a registered Consent Manager when one is used.
DPDP Act, Section 6(7) to 6(9); Rule 4; First Schedule
Personal data may be transferred abroad unless the Central Government restricts transfers to a country, and subject to any requirements it specifies by order. Sector laws that demand stricter localisation still prevail. Significant Data Fiduciaries may face localisation for data the government specifies.
DPDP Act, Section 16; Rules 13(4) and 15
The Act does not apply to processing necessary for research, archiving or statistical purposes, provided the data is not used to take a decision specific to an individual and the processing follows the standards in the Second Schedule. This helps institutional research and archives, but it is not a general exemption for running the institution.
DPDP Act, Section 17(2)(b); Rule 16; Second Schedule
For public authorities such as central and state universities, Section 44(3) of the DPDP Act replaced Section 8(1)(j) of the Right to Information Act, 2005, so that information which relates to personal information is exempt from disclosure. This has applied since 13 November 2025.
DPDP Act, Section 44(3); RTI Act, Section 8(1)(j)
| When | Requirement | Notes |
|---|---|---|
| 11 August 2023 | DPDP Act, 2023 enacted and published in the Gazette as Act 22 of 2023. | |
| 3 January 2025 | Draft DPDP Rules published for consultation (G.S.R. 02(E)). | |
| 13 November 2025 | Phase 1 in force. Act: Sections 1(2), 2, 18 to 26, 35, 38 to 43, and 44(1) and (3). Rules: 1, 2 and 17 to 21. The Data Protection Board of India is established, and the RTI personal-information amendment applies. | G.S.R. 843(E) and G.S.R. 846(E), both dated 13 November 2025. |
| 13 November 2026 | Phase 2 in force: Consent Manager registration (Act Section 6(9) and Section 27(1)(d); Rule 4). | The notifications say "one year" from publication. Some commentators give 14 November 2026 because the Gazette was uploaded on 14 November 2025; plan for the earlier date. |
| 13 May 2027 | Phase 3 in force: all remaining substantive duties, including notice, consent, security, breach intimation, children's data, rights, Significant Data Fiduciary duties, the Board's inquiry and penalty powers (Sections 3 to 17, 27 to 34), and Rules 3, 5 to 16, 22 and 23. | In January 2026 MeitY was reported to be considering shortening this window to 12 months for some obligations. We have found no notification making that change as at 15 October 2026. Later notifications are not described on this page. |
| Without delay, then within 72 hours | Breach intimation to the Board and to each affected person; detailed report to the Board within 72 hours of becoming aware, unless the Board allows longer on a written request. | Rule 7. From 13 May 2027. |
| Within 90 days at most | Respond to grievances from students, parents and staff, within the period you publish, which cannot exceed 90 days. | Rule 14(3). |
| At least 1 year | Keep personal data, traffic data and processing logs for a minimum of one year from the date of processing, then erase unless another law requires longer. | Rules 6(1)(e) and 8(3). |
| Every 12 months | Significant Data Fiduciaries only: a Data Protection Impact Assessment and an audit, with significant observations reported to the Board. | Rule 13. |
| 6 months (extendable) | The Board is to complete an inquiry within six months of receiving an intimation or complaint, extendable by up to three months at a time for recorded reasons. | Rule 19(9). |
| Breach | Maximum |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)) | Up to ₹250 crore |
| Failure to notify the Board or affected people of a personal data breach (Section 8(6)) | Up to ₹200 crore |
| Breach of the additional obligations for children's data (Section 9) | Up to ₹200 crore |
| Breach of Significant Data Fiduciary obligations (Section 10) | Up to ₹150 crore |
| Breach of a voluntary undertaking accepted by the Board (Section 32) | Up to the amount applicable to the original breach |
| Breach of any other provision of the Act or Rules | Up to ₹50 crore |
| Breach of a Data Principal's own duties, such as a false complaint or false particulars (Section 15) | Up to ₹10,000 |
We trace every flow of personal data across admissions, fees, LMS, exams, hostel, placements and alumni, identify the lawful basis and retention for each, and produce a prioritised gap report against the Act and Rules, timed to the 13 May 2027 date.
Itemised, standalone notices in English and Indian languages; granular consent with one-click withdrawal; and a parental consent flow for under-18 applicants that checks the parent through DigiLocker-based identity and age details. Consent records sit on the student's single record.
A separate tenant or VPC per institution hosted in India, with encryption, role-based access, masked views for staff who do not need full records, and one-year processing logs kept in India. The same log store meets the CERT-In 180-day rule.
A tested playbook that drafts the Board intimation and the 72-hour report, prepares plain-language notices to affected students and parents, and runs the CERT-In 6-hour report in parallel. We rehearse it with your team before you need it.
We review every edtech, ERP, LMS, CRM and proctoring contract for processing-on-behalf terms, security safeguards, breach cooperation, one-year log retention, erasure on exit and a ban on secondary use such as model training.
Retention schedules that keep what the law requires, such as degree and result records, and erase the rest on time, with immutable backups and erasure certificates that prove what was deleted and when.
A published contact point, a request portal keyed to enrolment ID, and a tracked workflow that answers access, correction and erasure requests well inside the 90-day ceiling.
Our online exams run proctoring with in-house AI models at the edge, so less raw video and audio leaves the candidate's device, with clear notices, defined retention and no third-party AI dependency.
Yes, in most cases. A child is anyone under 18, so for a 17-year-old applicant you need the verifiable consent of a parent before processing their personal data, unless a specific exemption applies (Section 9(1), Rule 10). In practice, add a parent step to the application: the parent identifies themselves, and you check they are an identifiable adult using reliable details you already hold or a DigiLocker-based identity and age token. Once the student turns 18, they become the Data Principal and can consent for themselves, so plan to re-confirm consent at that point. Whether an admission-time legitimate use or a Fourth Schedule purpose can cover any part of the application itself has not been confirmed by counsel on this page.
Yes, within limits. The Fourth Schedule lets an educational institution carry out tracking and behavioural monitoring of children without parental consent and despite the general ban, but only for its educational activities or in the interests of the safety of children enrolled with it. A transport operator engaged by the institution may track the location of children during travel to and from the institution. The exemption does not cover targeted advertising, or using that data for marketing or anything outside education and safety, and you must still never process a child's data in a way that harms their well-being (Section 9(2)).
Usually yes. If the vendor captures and analyses candidates' video, audio, screen and identity data only on your instructions and for your exam, it is your Data Processor, it must work under a valid contract (Section 8(2)), and you remain responsible for its security and breaches (Section 8(1)). If the vendor reuses that data for its own purposes, such as training its AI models, it becomes a Data Fiduciary for that purpose and needs its own lawful basis. Write the contract so that secondary use is prohibited, logs are kept for a year, and data is erased on schedule. For candidates under 18, check that proctoring fits the Fourth Schedule educational-activity condition. Whether that exemption extends to a processor acting for the institution has not been confirmed by counsel on this page.
The core duties, including notice, consent, security, breach intimation, children's data and penalties, apply from 13 May 2027. The Board already exists (since 13 November 2025) and Consent Managers can register from 13 November 2026. Real readiness work, such as rebuilding admission forms and vendor contracts, takes most of an academic cycle, so the 2027 admissions season is effectively your deadline.
No, not the records you must keep by law or regulation, such as degree, mark-sheet and other statutory academic records. Section 8(7) requires erasure once the purpose is served unless retention is necessary to comply with a law. What you should erase on schedule is everything else: rejected applicants' documents, old proctoring footage, marketing lists and the like. Note also that processing logs must be kept for at least one year (Rule 8(3)).
Both, from 13 May 2027. Under the DPDP Rules you inform the Board and each affected person without delay, and give the Board a detailed report within 72 hours (Rule 7). Under the CERT-In Directions you report the cyber incident to CERT-In within 6 hours of noticing it. The two duties run in parallel, so one runbook should trigger both. See our CERT-In page.
Only if the Central Government notifies it, or a class it belongs to, as one under Section 10. The factors include the volume and sensitivity of data, risk to people's rights and wider public-interest factors. Large multi-campus or online-degree institutions should watch for this, because SDFs must appoint an India-based DPO, an independent data auditor and run a yearly DPIA and audit. This page does not state whether any such notification has been issued.
A senior consultant reviews your data, systems and regulatory position with your team and gives you a written gap report. There is no cost and no obligation to buy anything.
A senior consultant reviews your data, systems and regulatory position with your team and gives you a written gap report, at no cost.