The short answer: the Digital Personal Data Protection Act, 2023 applies to any college that collects personal data about applicants, students, parents or staff. The college is the data fiduciary and answers for how that data is used, including by its vendors. The core duties in the 2025 Rules start on 13 May 2027.
This is the first of five posts. It explains the law in plain terms. The rest of the series covers what breaking it can cost, how to prepare in 24 weeks, what the ERP does and when to start.
Does the DPDP Act apply to a college?
Yes. The Act applies to anyone who decides why and how personal data is processed. A college decides this at every desk: admissions, fees, hostel, library, examinations and HR. There is no general exemption for educational institutions. The Rules give schools and colleges one narrow carve-out for children’s data, covered in the penalties and children post.
Who is who under the Act?
| Term in the Act | Meaning | At a college |
|---|---|---|
| Data principal | The person the data is about | Applicants, students, parents and guardians, staff, alumni, visitors |
| Data fiduciary | The organisation that decides why and how data is processed | The college, or the trust or society that runs it |
| Data processor | Anyone processing data on the fiduciary’s behalf | ERP provider, SMS and WhatsApp gateway, payment gateway, cloud host, biometric and CCTV vendors |
| Significant data fiduciary | A class the government can notify based on volume and sensitivity of data | Possible for a very large group; most colleges will not be one |
| Data Protection Board | The body that holds inquiries and imposes penalties | Set up in law; see when to start for its status |
The Act says the data fiduciary is responsible for compliance “in respect of any processing undertaken by it or on its behalf by a Data Processor” (section 8(1)). A college cannot hand its duties to a vendor.
What personal data does a college hold?
More than most colleges list. The table follows the data from desk to desk.
| Desk | Data held | Why it needs care |
|---|---|---|
| Admissions | Applicant and parent names, phone numbers, marks, ID proofs, photographs | Many applicants are under 18 |
| Students and hostel | Roll number, address, attendance, health notes, hostel and transport records | Health data and children’s data |
| Fees and accounts | Receipts, scholarships, bank details, parent income | Financial data |
| HR and payroll | Staff ID, PAN, UAN, bank details, salary, medical documents | Sensitive and long-lived |
| Library, exams, gate | Issue history, marks, gate entry, CCTV, biometric records | Tracks movement and behaviour |
| Vendors | Copies of the above held by SMS, payment, cloud, biometric and e-sign providers | Often not listed anywhere |
The last row is where most colleges have a gap. Listing your own desks takes an afternoon. A current list of which vendor holds which copy, under what contract, rarely exists.
What does the Act ask a college to do?
| Duty | Where it is set out | In plain words |
|---|---|---|
| Give notice | Section 5, Rule 3 | Tell people what you collect, why, how to withdraw consent and how to complain |
| Get valid consent | Section 6 | Free, specific, informed and tied to a purpose |
| Know your lawful uses | Section 7 | Consent, or a listed use such as data a person voluntarily gave for a stated purpose, or employment (section 7(i)) |
| Keep data accurate | Section 8(3) | Where data drives a decision about a person |
| Protect it | Section 8(5), Rule 6 | Reasonable security safeguards, with a minimum list |
| Report breaches | Section 8(6), Rule 7 | Tell affected people and the Board, with a 72-hour detailed report |
| Erase when the purpose ends | Section 8(7) | Delete or cause your processors to delete |
| Control vendors | Section 8(1), 8(2) | Valid written contract with each processor |
| Publish a contact and run a grievance route | Sections 8(9), 8(10), Rules 9 and 14 | Name a person to answer questions and respond to grievances within 90 days |
| Honour people’s rights | Sections 11 to 14, Rule 14 | Access, correction, erasure and nomination |
| Protect children’s data | Section 9, Rules 10 and 12 | Verifiable parent consent and limits on tracking and advertising |
Each row is the subject of a later post in this series. The 24-week plan puts them in order.
Is there a deadline?
Yes, and it is in phases. The Rules were published in the Gazette on 13 November 2025.
| Date | What starts |
|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21 |
| 13 November 2026 | Rule 4, on consent managers. No direct duty for a college |
| 13 May 2027 | Rules 3 and 5 to 16, 22 and 23: notice, security, breach reporting, children’s data, rights and grievances |
The detail, including a proposal to shorten the period, is in when should a college start DPDP compliance.
Where does an ERP fit in?
An ERP is a data processor in the Act’s terms. It holds the records, so it is also the system where consent, requests and logs can be kept. Tuling’s own security page states that the college remains the data fiduciary and Tuling acts as a processor for tenant-hosted records, so the college should have a written contract with its ERP provider like any other vendor. For what the ERP does and does not cover, read how Tuling ERP supports DPDP compliance.
Sources
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023, sections 2, 5 to 9, 11 to 14 and the Schedule. Checked 14 November 2026.
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Rules, 2025, Gazette G.S.R. 846(E), 13 November 2025, Rules 1, 3, 6, 7, 9, 10, 12 and 14. Checked 14 November 2026.
- Press Information Bureau, press release on the notification of the Rules, 14 November 2025.
This post explains the law in general terms and is not legal advice.
Update log
- 14 November 2026: first published.
Frequently asked questions
Does the DPDP Act apply to colleges and schools?
Yes. Any organisation that decides why and how personal data is processed is a data fiduciary under the Act. A college decides this for applicants, students, parents and staff, so the duties fall on the college.
Is a college a data fiduciary or a data processor?
A data fiduciary. A processor is a vendor that handles data on the college's behalf, such as an ERP provider, SMS gateway or payment gateway. The college stays responsible for what its processors do.
What counts as personal data at a college?
Any information about an identifiable person: names, phone numbers, marks, ID proofs, photographs, fee and bank details, attendance, health notes, library and gate records, CCTV, and staff payroll data.
Who is a data principal at a college?
The person the data is about. At a college that means applicants, students, parents and guardians, staff, alumni and visitors.
Is the college responsible for its vendors' handling of data?
Yes. Section 8(1) says the data fiduciary is responsible for processing done on its behalf by a processor, and section 8(2) requires a valid contract with each processor.
Does a college need a Data Protection Officer?
Only a significant data fiduciary must appoint a Data Protection Officer. Every fiduciary must publish the contact details of a person who can answer questions about processing.
When do the duties start?
Rule 1 of the DPDP Rules, 2025 brings notice, consent, security, breach reporting, children's data and rights duties into force on 13 May 2027, 18 months after the Gazette publication of 13 November 2025.
Facts last checked: 14 November 2026. Rules and dates change, so confirm with your own advisers before acting.
Find out where your college's data sits
Send us your current sheets and systems. We map who holds what, and which of the duties in this series your college already meets.
Book a data-map review- DPDP Act
- Data protection
- College compliance