The DPDP Act and your school: a plain-English compliance guide
· Adonai Team · 8 min read
The Digital Personal Data Protection Act makes every school a 'data fiduciary' for the children in its care - and children's data carries the strictest obligations in the law. You do not need a legal team to get the basics right, but you do need to stop treating student data casually.
The five things that matter most for a school:
1. Consent, from a parent, recorded. Collecting a minor's data needs verifiable parental consent - and you must be able to show when and how it was given.
2. Purpose limitation. Data collected for admission cannot be quietly reused for marketing.
3. The right to erasure. When a student leaves, families can ask you to delete personal data you no longer need to keep.
4. Breach notification. If data leaks, you are expected to report it - which means you first need to know it happened, i.e. an audit trail.
5. No unnecessary retention. Keep what the law and the board require; purge the rest on a schedule.
None of this is achievable with student data spread across teachers' personal phones and WhatsApp groups. It becomes straightforward when data sits in one system with named logins, role-based access, a consent record and a full audit trail - which is exactly how Adonix is built.