The short answer: a college can get ready for the DPDP Act in five stages over about 24 weeks. Map the data, give notice and take consent, secure the systems and contract the vendors, set up rights and breach response, then keep proof. The core duties start on 13 May 2027, so the plan has to begin now to leave any slack.
This is the third post in a series that starts with what the DPDP Act means for a college. If you want to know what the software covers, see how Tuling ERP supports DPDP compliance.
What are the five stages?
| Stage | Weeks | Output | Owner |
|---|---|---|---|
| 1. Map | 1 to 3 | A list of every data set, who holds it, why and where copies go | Registrar with IT |
| 2. Notice and consent | 4 to 8 | Plain notices for each audience and a consent record, including parent consent | Registrar and admissions |
| 3. Secure and contract | 6 to 12 | Access reviewed, logs on, signed vendor contracts | IT head |
| 4. Rights and breach | 10 to 16 | Grievance desk, request tracker, breach plan and a rehearsal | Principal’s office |
| 5. Prove it | 14 to 24 | Trained staff, kept logs, a dated review and an evidence file | All |
The stages overlap on purpose. Stages 1 to 3 are the ones to protect if the timeline gets tighter, for reasons covered in when to start.
Stage 1: how do we map our data?
List every desk and every system. For each data set, note what it contains, why it is collected, who can open it, which vendors hold copies, how long it is kept and whether it leaves India. The campus table in the first post is a starting list.
| Question for each data set | Why it matters |
|---|---|
| What is collected and from whom? | Notice must itemise the data (Rule 3) |
| For what purpose? | Consent and notice are tied to a purpose |
| Does it include children? | Section 9 and Rule 10 apply |
| Which vendors hold it? | You answer for them (section 8(1)) |
| Does it leave India? | Rule 15 allows transfers subject to government requirements |
| How long do you keep it? | You must erase when the purpose ends (section 8(7)) |
Common mistake: counting only the main ERP. Spreadsheets on staff laptops, WhatsApp groups and a biometric vendor’s cloud all count.
Stage 2: what must the notice and consent say?
Rule 3 says a notice must be understandable on its own, in clear and plain language. It must include an itemised description of the data and the specific purposes, plus a link or means to withdraw consent as easily as it was given, to exercise rights, and to complain to the Board.
| Audience | What the notice should cover |
|---|---|
| Applicants and parents | Application data, why it is collected, how long it is kept, who sees it |
| Students | Academic, attendance, fee, hostel and health data |
| Staff | Employment data, payroll, medical documents |
| Visitors and alumni | Gate entry, CCTV, alumni contact data |
For applicants under 18, build the parent step in before the form is processed. Rule 10 asks the college to check that the person is an identifiable adult, from details it already holds or details the parent provides, including through a virtual token such as one verified by a DigiLocker service provider. Keep a record of who consented, to what purpose and when, and give the parent a way to withdraw.
Stage 3: what does “reasonable security” include?
Rule 6 lists the minimum. The Rs 250 crore ceiling in the Act is attached to failing to keep reasonable safeguards, so treat this list as a checklist.
| Rule 6(1) item | What to check at the college |
|---|---|
| (a) Encryption, masking or tokens | What is encrypted, in storage and in transit |
| (b) Access control | Roles by desk, no shared logins, leavers removed the same day |
| (c) Logs and monitoring | Who opened which record, and someone who reviews it |
| (d) Backups and continued processing | A backup that has been restored at least once in a test |
| (e) One year of logs | Retention set to at least a year for logs and data used to investigate |
| (f) Processor contract | Safeguards written into each vendor contract |
Also decide how long you keep each data set. The Act requires erasure when the purpose is no longer served (section 8(7)).
Vendor contracts: keep a register of each processor, the data it holds, its contract status and whether it processes data outside India. The ERP provider is also a processor. Tuling’s security page says the college stays the data fiduciary and Tuling acts as the processor for tenant-hosted records, so sign a contract with every vendor, including ours.
Stage 4: how do we run rights, grievances and breaches?
Rights and grievances. Rule 14 asks you to publish how a person can make a request and what details you need to identify them, and to publish a grievance system with a response period not exceeding 90 days. People can also nominate someone to act for them. A tracker with an owner and a due date for each request is enough.
Breach response. Rule 7 sets the order.
| Step | When | What |
|---|---|---|
| 1. You become aware | Clock starts | Awareness, not the end of the investigation |
| 2. Tell each affected person | Without delay | What happened, likely effects, what you are doing, what they can do, who to contact |
| 3. Tell the Board | Without delay | Nature, extent, timing, location and likely impact |
| 4. Detailed report to the Board | Within 72 hours, or longer if the Board allows in writing | Facts and reasons, mitigation, who caused it, remedial steps, and a report on the notices you sent |
A cyber incident also falls under CERT-In’s separate six-hour reporting direction, which is outside the DPDP Rules. Keep both clocks in one plan.
Rehearse the first hour. Name an owner, decide who writes to families, and run a mock incident once. Section 33(2)(e) lists the speed and effectiveness of mitigation among the factors the Board weighs.
Stage 5: how do we prove it?
| Evidence | What it shows |
|---|---|
| Notices and consent log | You told people and recorded their choices |
| Parent consent records | You met the children’s rules |
| Access logs and review notes | You watch for misuse |
| Vendor register and contracts | You control your processors |
| Request and grievance tracker | You answer on time |
| Training record | Staff know their part |
| Annual review date | The plan is not a one-off |
Keep these in one folder. If a parent, an auditor or the Board ever asks, you hand it over.
What mistakes should a college avoid?
- Counting only the main ERP when mapping data
- Treating a privacy policy on the website as the notice
- Taking one blanket consent at admission for every purpose
- Leaving vendors out of the plan
- Skipping the breach rehearsal
- Setting log retention below one year
Sources
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Rules, 2025: Rules 3, 6, 7, 8(3), 9, 10, 14 and 15. Checked 14 November 2026.
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023: sections 8, 9 and 33. Checked 14 November 2026.
The five-stage plan and its timings are Tuling’s own planning suggestion, not a requirement of the law. This post is not legal advice.
Update log
- 14 November 2026: first published.
Frequently asked questions
What should a DPDP compliance checklist for a college include?
A data map, plain-language notices, consent records including parent consent for under-18s, security safeguards, vendor contracts, a grievance route, a breach plan, retention and erasure rules, and staff training.
How long does DPDP compliance take for a college?
Plan for about 24 weeks in five overlapping stages. Mapping takes 3 weeks, notices and consent 5, security and vendor contracts 7, rights and breach response 7, and building proof 11, with overlap.
Does a college need a Data Protection Officer?
Only a significant data fiduciary must appoint one. Every data fiduciary must publish business contact details of a person who can answer questions about processing (section 8(9), Rule 9).
What must a privacy notice say?
Under Rule 3 it must be understandable on its own, in plain language, with an itemised description of the personal data, the specific purposes, and links or means to withdraw consent, exercise rights and complain to the Board.
What must a college do after a data breach?
Tell each affected person without delay and tell the Board without delay. Within 72 hours, send the Board updated and detailed information, unless it allows longer. Rule 7 lists the content.
How long must a college keep logs?
Rule 6(1)(e) requires logs and personal data needed to detect and investigate unauthorised access to be kept for one year. Rule 8(3) also requires one-year retention of processing logs for specified purposes.
How should a college handle vendor contracts?
Use a valid written contract with each processor, with security safeguards written in (section 8(2), Rule 6(1)(f)). Keep a register of each vendor, what data it holds and whether data leaves India.
How fast must a college answer a grievance?
Rule 14(3) requires publishing a grievance system with a response period not exceeding 90 days, and measures to meet it.
Facts last checked: 14 November 2026. Rules and dates change, so confirm with your own advisers before acting.
Get the 24-week plan as a tracker
We set up the five stages with owners and dates for your college, and show which steps the ERP already records.
Talk to our team- DPDP Act
- Compliance checklist
- Data breach
- College compliance