The short answer: software cannot make a college compliant with the DPDP Act, and no certificate of compliant software exists. What an ERP can do is keep the proof: consent records, request trackers, grievance logs, a breach register and access trails. Tuling puts these in the same system that holds admissions, fees, HR and student records, so one record feeds every duty.
This is the fourth post in a series. Start with what the DPDP Act means for a college and the 24-week plan if you have not read them.
What does the ERP cover, duty by duty?
| Duty | Where it comes from | What the ERP provides | College still does |
|---|---|---|---|
| Notice | Section 5, Rule 3 | Privacy notices by audience, shown in the product | Edits the wording to the college’s own purposes |
| Consent at admission | Section 6 | A consent step before the applicant’s form, with a record of who agreed and when | Decides the purposes |
| Parent consent | Section 9(1), Rule 10 | A parent-linked consent record | Checks the parent is an identifiable adult |
| Staff consent | Sections 6, 7 | A consent roster with reminders for missing consent | Decides which uses rely on consent and which on employment |
| Rights requests | Sections 11 to 14, Rule 14 | Access, correction, erasure and nomination requests with a tracker | Publishes the request route and answers within time |
| Grievances | Section 8(10), Rule 14(3) | A grievance workbench with owner, status and due dates | Names who answers |
| Breach response | Section 8(6), Rule 7 | A breach register, affected-person notices and Board notice drafts | Owns the first hour and sends the messages |
| Vendors | Section 8(1), 8(2) | A processor register with agreement status and cross-border flag | Signs the contracts |
| Contact and oversight | Section 8(9), Rule 9 | A DPO dashboard and contact details | Publishes the contact on the website |
How does each module help?
Admissions. The applicant sees a privacy notice and a consent step before the form is processed. Uploaded documents are previewed with an audit record of who opened them. See college admission software for the module.
Student portal. Students see the data held about them and can ask for a correction or erasure. The request goes to the DPDP desk, not to an email inbox.
HR and employee self-service. Staff notice, a consent roster with reminders and rights requests for staff data, including the data held for payroll and statutory filings.
The DPDP desk. The college’s data-protection officer or nominated person sees open requests, grievances and breaches, the vendor register and the record of processing in one place.
Security and audit. Role-based access, session controls, sign-in controls and an activity trail. Covered in the next section.
For how these fit alongside NAAC, POSH and statutory desks, see the compliance hub.
What do audit trails and monitoring do for DPDP?
Rule 6 is the rule behind the Rs 250 crore ceiling, and it leans on visibility: who opened what, and whether anyone noticed.
| Rule 6(1) asks for | What the ERP offers | What to check |
|---|---|---|
| (a) Encryption, masking or tokens | Data in transit is protected with TLS, as stated on the security page | Ask what is encrypted at rest for your tenant |
| (b) Control of access | Role-based access by module, permission claims, session limits and sign-in controls | Review the role list at least twice a year |
| (c) Logs, monitoring and review | An activity trail of who did what and when, for sensitive actions such as fee waivers, payroll runs and access grants | Decide who reviews it and how often |
| (d) Backups | Automated database backups with point-in-time recovery, per the security page | Ask when a restore was last tested |
| (e) One year of logs | Activity logs stored with the records | Confirm the retention period is at least one year |
| (f) Processor contract | A vendor register with agreement status | Sign the contract with every vendor, including us |
The security page also describes a separate database for each college, hosting in India-region cloud infrastructure, and layered controls (role-based, attribute-based and risk-adaptive access, time-boxed grants and separation of duties). A trail only helps if someone reads it. Pick an owner who reviews exceptions on a schedule.
Monitoring and children. Section 9(3) bars “tracking or behavioural monitoring of children”. Logging staff actions and watching system security is a different thing from watching a student’s behaviour, but say so in the notice and keep student-facing monitoring to education and safety.
What does the ERP not do?
Be clear about this when you choose a vendor. Ask any vendor, including us, the same questions.
| Not done by software | Who owns it |
|---|---|
| Writing notices in the college’s own words | Registrar |
| Setting retention periods for each data set | Registrar and management |
| Checking that a person is an identifiable adult | Admissions desk |
| Signing contracts with every vendor | Management and legal advisers |
| Training staff and reviewing the programme yearly | Principal’s office |
| Deciding which uses need consent | Legal adviser |
If a vendor says “our software makes you compliant”, ask for what it does on each row above.
Why use the same system that holds the records?
A separate privacy tool has to be fed from the ERP. Data that is copied can fall out of date, and the proof is only as good as the copy. When consent, requests and logs sit beside the admission, fee and HR records, one search answers a parent’s question and one export answers an auditor’s. That is the argument for using the ERP’s DPDP desk, and it is why the same records appear in the earlier maps of campus data.
Sources
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Rules, 2025: Rules 3, 6, 7, 9, 10 and 14. Checked 14 November 2026.
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023: sections 5, 6, 8, 9 and 11 to 14. Checked 14 November 2026.
- Tuling Creative Hub, Security and compliance, for hosting, backups, access controls and the processor statement.
Product behaviour described here reflects Tuling’s published pages and internal notes as of the date above. This post is not legal advice.
Update log
- 14 November 2026: first published.
Frequently asked questions
Can software make a college DPDP compliant?
No. No certification of compliant software exists. Software can capture consent, track rights requests and grievances, keep access logs and a breach register, but notices, retention rules, contracts and training are the college's work.
What does DPDP consent management look like in an ERP?
A consent step before the applicant's form is processed, a record of who agreed to what purpose and when, a roster of staff consent with reminders, and a way to withdraw.
How does an ERP help with data principal rights requests?
Students and staff raise access, correction, erasure and nomination requests through their portal. The request lands in a tracker with an owner and a due date, which helps meet the 90-day grievance limit in Rule 14.
Which ERP security features does Rule 6 call for?
Rule 6 asks for encryption or masking, access control, logs with monitoring and review, backups, one year of logs and processor contracts. In an ERP that means role-based access, session controls, an activity trail and a vendor register.
What must a college still do outside the software?
Write notices in its own words, set retention periods, verify parents, sign contracts with every vendor including the ERP provider, train staff and review the programme every year.
How does an audit trail help after a breach?
Rule 7 asks for the facts, the reasons, who caused the breach and what was done. An access and activity trail is the record that lets a college answer those points within the 72-hour report.
Is Tuling a data processor or a data fiduciary?
For records hosted in a college's tenant, Tuling acts as a data processor and the college remains the data fiduciary, as stated on the Tuling security page. A written contract should cover this.
Facts last checked: 14 November 2026. Rules and dates change, so confirm with your own advisers before acting.
See the DPDP desk on your own records
We walk through consent, a rights request, a grievance and a breach rehearsal with your registrar and IT head.
Book a demo- DPDP Act
- College ERP
- Consent management
- Audit trail