School Software Data Security Checklist India: DPDP Act 2023 [2026]

<h2>The Most Sensitive Database in Your School Is Not the Exam Server</h2> <p>Walk into any Indian school office and you will find it: admission forms with Aadhaar copies, a shared Excel sheet of fee defaults with parents' phone numbers, and a WhatsApp group where a teacher has just posted a screenshot of a mark sheet. None of it feels like a data breach. All of it is personal data, and under the Digital Personal Data Protection Act, 2023, the school is legally answerable for every copy. This school software <strong>data security checklist India</strong> closes the gap between that cupboard and your ERP.</p> <p>Most principals treat DPDP as a vendor problem. It is not. The school is the Data Fiduciary; the software company is only a Data Processor acting on your instructions. If a student's record leaks because an admin login was shared with the office boy, the liability sits with the school, not the vendor whose logo is on the login page.</p> <h2>What the DPDP Act 2023 Actually Requires From a School</h2> <p>The Act received presidential assent on 11 August 2023 and is India's first horizontal data protection law. The rules that operationalise it were notified in 2025, with obligations phased in. You need four duties and one number.</p> <ul> <li><strong>Notice and consent:</strong> parents must be told what you collect, why, and how to withdraw consent. A clause inside an admission form is not a notice.</li> <li><strong>Purpose limitation:</strong> collect what the school needs. Aadhaar, caste and income are not "just in case" fields.</li> <li><strong>Reasonable security safeguards:</strong> encryption, access control and backups proportionate to the data you hold.</li> <li><strong>Breach notification:</strong> inform the Data Protection Board and affected parents.</li> </ul> <p>The number is 18: a child is anyone below 18, and processing children's data requires verifiable parental consent. Most school ERP contracts in India currently ignore that clause.</p> <p>In short: the parent or student is the Data Principal, the school is the Data Fiduciary, and every vendor touching a record is a Data Processor.</p> <h2>The 12-Point School Software Data Security Checklist India</h2> <p>Use this at the shortlist stage, not after implementation. Each row has a question to email the vendor and a red flag that should end the conversation. If a vendor cannot answer three or more in writing, you are buying exposure, not software.</p> <table> <thead><tr><th>#</th><th>What to check</th><th>What "good" looks like</th><th>Red flag</th></tr></thead> <tbody> <tr><td><strong>1</strong></td><td>Data processing agreement</td><td>Signed DPA naming the school as fiduciary and the vendor as processor</td><td>"Our standard terms are on the website"</td></tr> <tr><td><strong>2</strong></td><td>Sub-processors</td><td>A written list of every third party touching your data, plus locations</td><td>"We can't disclose our stack"</td></tr> <tr><td><strong>3</strong></td><td>Encryption</td><td>TLS in transit, AES-256 at rest, encrypted backups</td><td>"It's behind a login" offered as the whole answer</td></tr> <tr><td><strong>4</strong></td><td>Access control and audit logs</td><td>Role-based access plus a log of who viewed or exported a record</td><td>One admin login shared by the whole office</td></tr> <tr><td><strong>5</strong></td><td>Data minimisation</td><td>Only fields CBSE, ICSE or the state board requires; Aadhaar optional</td><td>Mandatory Aadhaar and income fields at admission</td></tr> <tr><td><strong>6</strong></td><td>Retention and deletion</td><td>A defined retention period and automatic purge after it</td><td>"We keep everything forever, it's safer"</td></tr> <tr><td><strong>7</strong></td><td>Export and exit</td><td>Self-serve export of all records, plus a deletion certificate on exit</td><td>Data released only via a paid support ticket</td></tr> <tr><td><strong>8</strong></td><td>Breach notification</td><td>Contractual duty to notify within a stated window, with facts</td><td>No breach clause at all</td></tr> <tr><td><strong>9</strong></td><td>Children's data</td><td>Verifiable parental consent, no behavioural tracking or targeted ads</td><td>Analytics pixels on the parent app</td></tr> <tr><td><strong>10</strong></td><td>Backups and recovery</td><td>Daily backups stored in India, with restore-test evidence</td><td>"Backups are handled by the cloud" with no proof</td></tr> <tr><td><strong>11</strong></td><td>Staff exit process</td><td>Immediate revocation on exit, with a departure log</td><td>Ex-employees still on the user list in year three</td></tr> <tr><td><strong>12</strong></td><td>Independent testing</td><td>A VAPT report from the last 12 months, or ISO 27001 / SOC 2 certification</td><td>"We have never had a complaint"</td></tr> </tbody> </table> <p>Points 4, 7 and 12 separate a real platform from a demo: audit logs answer "who downloaded the Class 10 fee list last Tuesday", export tells you whether you can leave, and testing proves someone outside the company checked the claims.</p> <h2>The Vendor Security Questionnaire to Send Before You Sign</h2> <p>Do not let a salesperson answer these on a call. Send them by email and ask for written answers with dates and document names. A vendor who replies in two days has a security function; one who sends a brochure has a marketing function.</p> <ol> <li>Where is student data stored, and is any of it replicated outside India?</li> <li>Which sub-processors receive our data, including SMS, WhatsApp and payment providers?</li> <li>Who inside your company can see a named student's record?</li> <li>When did you last complete a VAPT, and can you share the summary?</li> <li>How do you detect a breach, and in how many hours will you notify us?</li> <li>Can we export and delete all our data ourselves, and what happens to backups after deletion?</li> <li>How is verifiable parental consent captured for students under 18?</li> <li>Which employee accounts were revoked last quarter?</li> </ol> <p>Two are non-negotiable: where backups sit and the breach timeline. If no notification window appears in the contract, assume it is "when it becomes public". Pair this with the <a href="/blog/post/school-software-vendor-reference-check-india-10-questions-2026/">reference-check questions</a>.</p> <h2>Children's Data: The Under-18 Rule Most Schools Miss</h2> <p>The Act treats every student below 18 as a child, including Class 12 students handling their own fee payments. That triggers three obligations most Indian school apps were not designed for. Consent must be verifiable and given by a parent, not by a student clicking "I agree". Behavioural monitoring is restricted, ruling out the engagement analytics copied from consumer apps. And targeted advertising at children is prohibited, so a vendor cannot monetise your parent base by selling ad inventory against student profiles.</p> <p>Ask for the actual consent screen, not a description. If parental consent is a checkbox inside the admission form, it is not verifiable and the school carries the risk. Old spreadsheets of children's data must be deleted too, not carried forward "just in case" — the lesson in our <a href="/blog/post/school-data-migration-what-to-bring-what-to-leave-2026/">data migration guide</a>.</p> <h2>When a Breach Happens: The First 48 Hours</h2> <p>Assume it will happen once: a clerk emails a fee-default list to the wrong parent group, a shared login survives a staff exit, a vendor's server is misconfigured for six hours. The penalty depends less on the incident than on whether the school had a plan and followed it.</p> <p>Write five things down before the event: who declares an incident, who calls the vendor, who drafts the parent communication, who notifies the Data Protection Board, and where evidence is stored. Notification must reach the Board and affected parents without delay, in the prescribed form. Waiting a week to "confirm the full scope" is the mistake regulators penalise.</p> <h2>Penalties: What a Leak Can Cost a School</h2> <p>The schedule sets maximum penalties, not fixed fines. The Board weighs the nature and duration of the breach, your safeguards and your cooperation. The ceilings are still large enough to end a mid-sized trust's expansion plans.</p> <table> <thead><tr><th>Failure</th><th>Maximum penalty</th></tr></thead> <tbody> <tr><td>Failure to take reasonable security safeguards against a personal data breach</td><td>Up to ₹250 crore</td></tr> <tr><td>Failure to notify the Board or affected parents of a breach</td><td>Up to ₹200 crore</td></tr> <tr><td>Breach of children's data obligations, including verifiable parental consent</td><td>Up to ₹200 crore</td></tr> <tr><td>Other breaches of the Act</td><td>Up to ₹50 crore</td></tr> </tbody> </table> <p>Read those numbers next to your software budget. A school paying ₹1.5 lakh a year for an ERP will not absorb a ₹250 crore exposure, so the Board will ask whether you exercised reasonable care. Documented vendor due diligence is your best evidence.</p> <h2>A 30-Day Plan You Can Actually Run</h2> <p><strong>Week 1:</strong> inventory every place student data lives, from the ERP to the transport app and old hard disks. <strong>Week 2:</strong> send the checklist and questionnaire to every vendor and request the DPA. <strong>Week 3:</strong> revoke shared logins, remove ex-staff accounts, restrict exports to named roles, switch on audit logs. <strong>Week 4:</strong> write the incident playbook, train the office team, and publish a plain-language privacy notice for parents.</p> <p>Thirty days will not make a school bulletproof. It will make it defensible, which is the standard the Act applies, and expose the vendors who cannot answer basic questions before you renew.</p> <h2>Security Is a Buying Criterion, Not an IT Detail</h2> <p>The cheapest way to fail a DPDP audit is to buy software that was never designed to pass one. A checklist principals can hand to a vendor is worth more than a discount, because the discount is one-time and the liability is annual. Start with the contract, then the audit logs, then the consent flow, then ask for proof. <a href="https://www.meity.gov.in/content/digital-personal-data-protection-act-2023" target="_blank" rel="noopener">The DPDP Act text</a> is public and shorter than most expect; the <a href="https://udiseplus.gov.in/" target="_blank" rel="noopener">UDISE+ dashboard</a> shows how much student data Indian schools now hold.</p> <p><a href="/saksham/">Eduspheria Saksham AI</a> is built for this standard: role-based access, audit trails on student records, data stored in India, self-serve export, and a written processing agreement at onboarding. If your current vendor cannot answer question four above, it is time for a <a href="/blog/post/school-software-lock-in-the-15-questions-before-you-sign-2026/">hard look at your contract</a>. Book a free demo at <a href="https://eduspheria.com/">eduspheria.com</a> and bring the checklist with you.</p>