Vacademy Research · Compliance guide
DPDP Act Checklist for Schools, Coaching Institutes and Online Academies
Most duties under India's Digital Personal Data Protection Rules apply from 13 May 2027, including verifiable parental consent for anyone under 18. This guide explains what changes for education institutes and gives a 12-point checklist you can tick through in five minutes.
By the Vacademy research team · Published · Updated
This is a practical summary for institute owners, not legal advice. For decisions about your institute, check the official text[5] or ask a lawyer.
Key dates and numbers
most duties apply: notices, consent, security, breach reporting, children's data.[1]
counts as a child; their data needs verifiable parental consent outside the education exemption.[1]
maximum penalty for failing to take reasonable security safeguards.[3]
When the rules apply
| Date | What applies |
|---|---|
| 13 Nov 2025 | DPDP Rules 2025 notified; Data Protection Board provisions in force |
| 13 Nov 2026 | Consent-manager rules |
| 13 May 2027 | Most duties: notices, consent, security safeguards, breach reporting, children's data |
The Rules were notified as G.S.R. 846(E) on 13 November 2025 with a phased start[1].
What is different for education institutes
Educational institutions get a partial exemption for children's data: they may process it without parental consent for their own educational activities and for children's safety[4]. The exemption does not cover sharing student data with marketing, advertising or analytics vendors, so an institute that runs retargeting ads, buys lead lists or shares data with third parties still needs to meet the full rules.
Coaching centres and online academies should check whether they count as an educational institution for this purpose before relying on the exemption. Their admissions and marketing activity usually falls outside it either way.
Penalties
| Failure | Maximum penalty |
|---|---|
| Not taking reasonable security safeguards to prevent a breach | ₹250 crore |
| Not notifying the Board and affected people of a breach | ₹200 crore |
| Breaking the additional obligations for children's data | ₹200 crore |
| Other breaches of the Act or Rules | ₹50 crore |
Penalties are set by the Data Protection Board case by case, up to these limits in the Schedule to the Act[3][2].
The 12-point readiness checklist
Tick what your institute already does. The score is not stored or sent anywhere.
Several basics are missing. Most institutes in this position start with the data map and vendor contracts.
What to ask your software vendors
- Where is our data stored, and can we export all of it at any time?
- Who on your side can access our student and parent data, and is that access logged?
- Can we give each staff role access to only the data it needs?
- How and how fast will you tell us about a breach, so we can meet the 72-hour report?
- Do you use our learners' data for your own marketing or for AI training?
Vacademy offers role-based access with single sign-on, TLS encryption in transit, per-institute data isolation, automated backups and data export on request. See why institutes choose Vacademy, or compare platforms in the Education Platform Landscape 2026.
Sources
- [1] MeitY notifies Digital Personal Data Protection Rules, 2025 — SCC Online (Primary)
- [2] DPDP Act 2023 and Rules 2025: point of view — EY India (Survey)
- [3] The Schedule (penalties) to the DPDP Act, 2023 — dpdpa.com (Primary)
- [4] DPDP Rules and the future of child-data safety — Observer Research Foundation (Survey)
- [5] Digital Personal Data Protection Act, 2023 (Gazette of India, No. 22 of 2023) — Government of India, copy hosted by TRAI (Primary)
- [6] Data protection framework — Ministry of Electronics and IT (Primary)