Free download
The 100-Point DPDP Readiness Checklistfor Indian educational institutions
A plain-language self-assessment against the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Ten sections, a hundred questions, about twenty minutes.
Three of the hundred
You have noted that the DPDP Act, 2023 contains no general exemption for educational institutions, and that the relaxations in the Fourth Schedule are narrow and purpose-specific rather than a blanket carve-out.
You obtain verifiable consent from a parent or lawful guardian before processing the personal data of a child, as required by section 9.
You have a written contract with every party that processes personal data on your behalf, including the ones procured informally.
Tick only what is true today. The value is in the boxes you cannot tick.
Why this exists
Most institutions I speak to believe education is exempt from the new data protection law. It is not. Admission forms, CCTV, transport apps, biometric attendance, WhatsApp groups with parents, the visitor register at the gate, all of it is personal data, and a great deal of it belongs to children, which the Act treats with particular care.
The principal operational obligations commence on 13 May 2027. That sounds distant until you count the forms, vendors and archives a single institution has to work through. This checklist is the fastest honest way to find out where you stand.
What it covers
- 1Scope: does the law actually apply to you10
- 2Know what you hold: inventory and mapping10
- 3Notice: telling people what you do10
- 4Consent, and the higher bar for children10
- 5Purpose limitation and retention10
- 6Rights of individuals, and how you answer them10
- 7Vendors, processors and contracts10
- 8Security safeguards10
- 9Breach: preparation and response10
- 10Governance, accountability and audit10
Pick the version for your institution
The same hundred points, worded for the records you actually keep.
Download the checklist
A thirteen-page PDF. No sign-up, no form, nothing to fill in. Take it, use it with your admin team, and pass it on to anyone in the sector who needs it.
Download the PDFWe ask for nothing in return, which is the only defensible way to run a lead magnet about data minimisation.
Where the checklist came from
This is a condensed piece of my book, Data Protection in Indian Education, which works through the Act and the 2025 Rules as they apply to schools, colleges, universities and coaching institutions. It includes the notices, consent wording, retention schedules, processor clauses, breach runbooks and audit checklists in a form you can adapt for your own institution.