Your institution does not just educate students. It collects, monitors and shares student data every day.

Yes. Schools and colleges process large volumes of student and parent personal data — admission forms, ID proof, marks, fee records, health details, photos and contact information — which makes them Data Fiduciaries under the Digital Personal Data Protection Act, 2023. Because most schools handle children's data, additional safeguards apply regardless of the institution's size.

Data of students below 18 is treated as children's data. Processing it generally needs verifiable parental/guardian consent, and the law restricts tracking, behavioural monitoring and targeted advertising directed at children. In practice the key control is a clear admission-time notice and documented parent consent covering school apps, photos, CCTV, transport, LMS and vendor platforms — not just a website privacy policy.

You can, but for minors this is a high-sensitivity workflow. Take separate, documented consent for publishing photos, videos and results, tell parents where images will appear, and offer a simple removal process on request. Publishing student images and results publicly without separate consent is a common DPDPA gap for schools.

These safety systems are legitimate, but they create continuous monitoring and location data — especially for children. You need a defined purpose, access controls over who can view footage or location, a retention limit, and visible notice/signage. Biometric data is sensitive and hard to revoke, so it needs particular care.

The DPDPA expects data to be kept only as long as the purpose requires. The risk for schools is keeping old admission files, parent contacts, app data, photos and CCTV footage indefinitely with no documented schedule, access control or review. Define a retention period by record type and archive or delete past it.