For Indian schools
The DPDP Act, for people who run schools.
A school holds more children's data than almost any other kind of organisation, and the Act treats a child's data more strictly than an adult's. Here is what it asks of you, and what the software does about each part.
This is a plain-English summary written by the people who built the software, not legal advice. Your school should take its own counsel — but you should be able to have that conversation without starting from zero.
Why a school is unusual
Almost everything a school records is personal data about a child: name, photograph, attendance, marks, health notes, transport stop, the times a parent collects them. Under the Act, a child is anyone under eighteen, and processing their data carries obligations that do not apply to an adult's.
The two that bite hardest are verifiable parental consent, and a prohibition on tracking or behavioural advertising directed at children. The first is an operational problem. The second rules out a whole category of product that schools are routinely offered.
What the Act asks, and what the software does
Consent that can be shown
Consent is recorded per purpose, with who gave it, when, and what they were told at the time. A tick-box nobody can reconstruct later is not consent you can rely on.
Verifiable parental consent
For a child, consent comes from the parent, and the school must be able to show it was that parent. The parent's identity is established through the account the school itself created — not by a stranger claiming to be a parent.
Withdrawal that is as easy as giving
A parent can withdraw consent from their own account, and withdrawal takes effect immediately and backwards — a photograph consent withdrawn today stops that child appearing in albums shared last term.
Erasure, where the law allows it
A family can ask for erasure, and it is executed by the school. Some records a school is legally required to keep for a period, and the software distinguishes the two rather than pretending the choice is free.
No behavioural tracking of children
There is no advertising, no behavioural profiling, and no third-party analytics receiving a child's record. This is why there is no advertising model here at all.
A grievance officer, named
The Act requires a named contact who answers data requests. Ours is published, and yours can be published on your own school portal.
The questions schools ask
- Are we the Data Fiduciary, or are you?
- For your students' records, your school decides why and how the data is processed, so the school is the Data Fiduciary and Edustians is a processor acting on your instructions. That distinction matters and should be in your contract with any vendor.
- What about the photographs we already share on WhatsApp?
- That is exactly the practice the Act makes uncomfortable, because you cannot show consent and cannot withdraw it. It is the single most common thing we help schools move.
- Does a parent's withdrawal break our records?
- No. Withdrawing consent for photographs stops photographs being shown. It does not erase attendance or marks, which the school holds under a different basis.
- What if a child turns eighteen?
- The rights move to them. That is handled by the software rather than by somebody remembering.
Bring this page to your counsel.
It is written to be the start of that conversation rather than a substitute for it. Ask us anything it raises.