DPDPA readiness for schools, colleges, and universities.
Educational institutions hold personal data for students who are children and students who are adults in the same system, often for years after either group has left. Readiness work here usually starts with getting consent right for the students who are minors, and knowing how long you're actually meant to keep everyone else's records.
What personal data typically looks like here
Where this usually creates the most work
Consent that treats minors and adults differently
A school's students are children under the DPDPA — anyone under 18 — while most college and university students aren't. That difference changes who gives consent and how it needs to be worded; a single form written for adults doesn't hold up for a 14-year-old.
What the DPDPA says about children's dataVendor sprawl from ed-tech platforms
Learning management systems, online testing and proctoring tools, and payment gateways all touch student data on your behalf. Each one is a vendor worth reviewing, not just the systems your own IT team set up directly.
Vendor review checklistOne student record, touched by many departments over years
Admissions, academics, administration, the hostel office, and later the alumni office can all touch the same student's record at different points. Readiness work usually starts with mapping who actually has access today, not who's supposed to.
Processing Register templateRetention that outlasts a student's time with you
Transcripts and degree records are often requested years, even decades, after someone graduates, which is a real reason to keep them — but that reason needs to be documented, not assumed, and it doesn't automatically extend to every other category of data collected along the way.
Other industries
Readiness work looks different depending on how your organisation uses personal data.
See where your organisation stands.
Ten minutes, no legal jargon, no commitment.