DPDP Act for Education Institutions: Checklist
By Vidyarthi Database editorial team · Published 2026-09-21 · Updated 2026-09-21 · General information, not legal advice
Short answer: The Digital Personal Data Protection Act, 2023 asks organizations that decide how student data is used to give clear notice, obtain valid consent or rely on a lawful ground, collect only what they need, protect it, and respond to people who ask about their data. Children under 18 get stronger protection. This is general information, not legal advice.
Key takeaways
- Know whether your organization decides why and how student data is used: that makes you a data fiduciary under the Act.
- Tell people what you collect, why, and how to withdraw consent or complain, before you collect it.
- Collect only what you need, protect it, and delete it when the purpose ends.
- Children (under 18) need verifiable parental consent, and tracking or targeted advertising aimed at them is restricted.
- Check the current status of the Act's rules and get legal advice for your situation.
Why education institutions are affected
Colleges, coaching institutes and admission consultants collect names, phone numbers, marks, addresses, family details and sometimes identity documents. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), the person whose data it is is called the data principal, and the organization that decides why and how the data is processed is called the data fiduciary. If you run an admission campaign, keep an enquiry register or buy contact lists, you are very likely a data fiduciary for that data.
The Act and its rules are being brought into force in stages, so the exact dates and details you must follow depend on when you read this. Always check the official texts published by the Ministry of Electronics and Information Technology and ask your lawyer which provisions already apply to you.
The core ideas in plain words
- Notice: tell people, in clear language, what data you collect, why, and how they can exercise their rights or complain.
- Consent or another lawful ground: personal data should be processed with valid consent, or under one of the specific lawful uses the Act allows. Consent should be free, specific, informed and easy to withdraw.
- Purpose limitation: use the data only for the purpose you told people about.
- Data minimisation: collect only what you need for that purpose.
- Accuracy and security: keep data reasonably accurate and protect it with sensible safeguards.
- Retention: delete the data when the purpose is served or consent is withdrawn, unless the law requires you to keep it.
- Breach handling: have a way to detect a personal data breach and to report it as the law requires.
- Rights and grievances: give people a way to ask about, correct or erase their data and to raise complaints.
Children: the rule that matters most for admissions
The Act treats a person under 18 as a child. For children, the Act requires verifiable consent of a parent or lawful guardian before processing personal data, and it restricts tracking, behavioural monitoring and targeted advertising directed at children. Some limited exemptions can be notified by the government.
Many NEET, JEE and CUET aspirants are 17 or 18. If your list may include minors, do not assume that a phone number in a spreadsheet means you may contact the student. Treat that outreach as high risk and get legal advice on how to obtain and record parental consent, or whether to direct communication only to a parent or guardian who has given it.
A practical checklist for your team
- Map your data: list every place student data enters (forms, walk-ins, events, purchased lists, WhatsApp) and where it is stored.
- Write a short, plain-language privacy notice and show it wherever you collect data.
- Decide your lawful ground for each use, and keep proof of consent where you rely on it.
- Separate marketing from service: an enquiry about one course is not permission for every campaign.
- Set retention periods and delete data on schedule.
- Restrict access to named staff, and use strong passwords and two-factor sign-in on any system that holds student data.
- Keep a simple process to handle access, correction and erasure requests, and a named contact for grievances.
- Write a short breach plan: who to tell, what to record and how to notify.
- Check any supplier or data vendor: ask where the data came from and what you are permitted to do with it.
Buying or receiving data from a third party
If someone sells you a list, you are still responsible for how you use it. Ask for the source and the permitted use in writing, ask how consent was obtained, and ask how removal requests are handled. If the answers are vague, treat the list as unsafe. A seller that cannot explain provenance is transferring its risk to you.
Penalties and enforcement
The Act provides for significant financial penalties for serious failures such as inadequate security safeguards or failing to protect children's data, and it establishes a Data Protection Board to handle complaints. The exact amounts and procedures are set out in the Act; read them in the official text and ask your lawyer how they apply to your organization.
What to do this month
- Ask your lawyer which DPDP provisions currently apply and what they mean for admission outreach.
- Draft and publish a privacy notice and a contact for requests.
- Review every list and campaign that may involve minors, and pause anything you cannot justify.
- Turn on two-factor sign-in and access limits for systems that hold student data.
Frequently asked questions
Does the DPDP Act apply to a small coaching institute?
Is a phone number personal data?
Can I keep contacting students who enquired last year?
Where can I read the Act?
Official sources to check
Rules, dates and fees change every cycle. Confirm them on the official websites below.