The Digital Personal Data Protection Act treats a child’s data more strictly than an adult’s: processing generally requires verifiable parental consent, and tracking or behavioural advertising directed at children is prohibited. For a school the practical questions are what you collect, who can see it, and what happens when consent is withdrawn.
This is a plain-language summary written for school administrators, not legal advice. Rules under the Act have been issued in stages — take a lawyer’s view before relying on any position here.
Most DPDP writing aimed at schools is either a summary of the statute or a vendor claiming compliance on your behalf. Neither helps the person who actually has to decide whether the class WhatsApp group is a problem.
The exposures that actually occur in schools are mundane. A teacher’s personal phone holding every parent’s number. A class group where forty families can see each other’s numbers. A marks list circulated as an image. A staff member who left in March whose login still works.
None of these is exotic and all of them are decisions. Messaging from the school’s own number rather than a teacher’s, results visible to a family rather than broadcast, and access removed on the day someone leaves are the three that remove most of the risk without a policy document.
A vendor can give you field-level permissions, an audit trail, encryption, data residency and an export. A vendor cannot be your consent basis, cannot decide your retention policy, and cannot make you compliant — the school is the entity deciding what to collect and why, and that responsibility does not transfer with a subscription.
Treat any claim of "DPDP compliant software" accordingly. The useful question to ask instead is which of the four decisions above the product actually helps you implement.
Phrased the way they arrive, answered so each one stands on its own.
Schools process personal data of children at scale, so yes in substance. The stricter treatment of children’s data — verifiable parental consent, and a prohibition on tracking and behavioural advertising directed at them — is the part most relevant to a school.
Take your own legal view. What is clear operationally is that a group exposing every family’s number to every other family is a disclosure the school chose, and messaging from the school’s own number to individual recipients avoids it.
No, and be sceptical of the claim. Compliance is a property of what your institution does with data, not of a product. Ask which decisions the product helps you implement and evidence.
Checked by the Implementations desk on 7 September 2026. Corrections go in the page, dated, rather than quietly.
Pricing is on the page, in the open, with the counting rule written next to it. Nobody has to book a call to find out what it costs.
See pricingForty minutes with an implementation engineer — your classes, your fee heads, your grading scheme, entered as we go. No slides, no sample school.