Available
Data Protection in Indian Education
A Whole-of-Institution DPDP Manual.
A practical guide to institutional compliance under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, with frameworks, playbooks and sixty-eight ready-to-use tools for higher education institutions and schools.
Why this book
Every school, college and university in India is now a regulated processor of personal data. The DPDP Act, 2023 and the Rules of 2025 reach the five-teacher private school and the forty-thousand-student university with the same text, and the clock to full enforcement is already running.
Can the class teacher post the marks list in the parents' WhatsApp group? What happens when a parent refuses the APAAR consent form? Who answers when a recruiter reuses last season's CV book? This manual answers such questions the way institutions actually work: by desk, by record and by owner.
It maps the fourteen populations whose data every campus holds, builds governance across the student, research, partnership and HR estates, and lands every obligation on one of sixty-eight ready-to-use tools. A dedicated School Supplement covers children's data, government schools, APAAR and UDISE+.
The institution that is not yet compliant is already processing.
What is inside
- LawUnderstanding the law, before any of it is applied
- StudentStudent data governance, from enquiry and admission through records and alumni
- ResearchResearch data governance, ethics approvals and the research purpose
- PartnershipsPartnership and institutional data governance, for every relationship that moves data outward
- HRThe HR compliance framework for staff and employment data
- SchoolsThe School Supplement: K-12 institutions, children's data, government schools, APAAR and UDISE+
- ToolsAnnexures, sixty-eight ready-to-use tools and a full FAQ part
The part readers mention most
Ready to adapt
- Sixty-eight numbered tools, indexed so a chapter points straight at the artefact it needs
- Notice wording for admission, enquiry, transport and medical forms
- Consent architecture, including verifiable parental consent and the handover when a student turns eighteen
- A retention schedule by record type, distinguishing what law requires you to keep from what you simply never deleted
- Processor clauses for your ERP, transport, hosting and app vendors
- A breach response runbook, written to be used by a stressed office at an awkward hour
- An audit checklist your internal auditor or governing body can work from
Who it is for
Heads of institution, registrars, administrative officers, IT coordinators and anyone likely to be handed the data protection file. Three reader personas run through every chapter, so a small trust school and a multi-entity university each know which paragraphs are theirs. It assumes no legal background, and where a point is genuinely unsettled the book says so rather than manufacturing certainty.
Not sure yet? Start with the free 100-Point DPDP Readiness Checklist. It takes about twenty minutes and it will tell you whether you have a problem worth reading a book about.
Get a copy
Available in print from Notion Press and on Amazon. Institutional pricing applies from five copies, with better rates at ten and fifty, and library supply can go through your usual vendor or directly.
Paperback, Notion Press Hardcover, Notion Press Also on Amazon Ask about institutional copiesBuying direct from Notion Press supports the author most; the book is the same either way. Paperback Rs 1,450 (ISBN 979-8-90673-565-2), hardcover Rs 1,575. 400 pages. The law is stated as on 4 August 2026. For a formal quotation, a proforma invoice or an ISBN for cataloguing, write and say what your purchase process needs.
Sessions for institutional teams
I run occasional working sessions for the offices that will carry this obligation. Ninety minutes, built around your own admission forms, vendor contracts and systems rather than a general presentation on the law. Institutions tend to get more out of that than out of the copies alone, because the room leaves with decisions rather than notes.
Other titles in the series
DPDP Act Compliance Handbook
A Practical, Entity Scale Guide to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
Forthcoming · Harmeet Singh KapoorDPDP for IT and ITeS
Law, Engineering and Governance of India's Data Protection Regime. A sector reference in twenty-eight chapters.
Forthcoming · Harmeet Singh KapoorDigital Personal Data Protection in Indian BFSI
From law to ground reality, technology, governance and compliance. A practical implementation companion for banks, NBFCs and FinTechs in India.
Forthcoming · Harmeet Singh KapoorThe DPDP Act in the Age of AI
Compliance Engineering for Artificial Intelligence under India's Digital Personal Data Protection Act, 2023 and the Rules of 2025.