One student. Many systems. One institute's responsibility.
Follow one student's record as it moves through enquiries, counselling, admission, fees, classrooms, LMS platforms, assessments, WhatsApp groups, placements and years of archives - and count every place it ends up, and where you lose control of it.
- 1
Marketing & enquiry control breaks
+7 places · 7 so farA prospective student or parent responds to an ad, a banner, a website or a referral. Contact details are captured on paper, on WhatsApp or through a web form before any controlled system exists.
Where control breaks: Children's numbers and photos in open WhatsApp groups
Moving hereStudent identity (new at this stage)Parent / guardian details (new at this stage)Contact data (new at this stage)Education & eligibility (new at this stage)Behavioural & learning analytics· inferred (new at this stage)DPDPAGive a short notice at the point of collection, take only what counselling needs, and never begin tracking a minor before a parent can see the notice.
- 2
Counselling & course guidance
A counsellor discusses courses, fees and eligibility - capturing career goals, academic background and parent contact in notebooks, spreadsheets, CRM notes and WhatsApp chats.
Moving hereContact dataEducation & eligibilityDPDPAKeep counselling notes factual and relevant, move documents off personal chat, and avoid collecting family or financial detail the course does not need.
- 3
Admission, documents & consent control breaks
+2 places · 9 so farThe student enrols. Identity, education records, photographs, guardian details and often ID proof are collected - and admission consent frequently bundles marketing, photography and communication into one signature.
Where control breaks: Aadhaar and certificate photocopies kept forever
Moving hereID documents (new at this stage)Photos, videos & recordings (new at this stage)Student identityParent / guardian detailsContact dataEducation & eligibilityDPDPASeparate what is mandatory from what is optional, avoid Aadhaar unless genuinely required, and record verifiable parental consent for a minor.
- 4
Fees, instalments & payments
+4 places · 13 so farFees are paid by cash, UPI, a payment gateway or a subscription. Payment references, instalment plans and screenshots spread across receipt books, gateways, spreadsheets and phones.
Moving hereFees & payment data (new at this stage)Student identityContact dataDPDPARestrict finance access, do not share fee status in open groups, and stop keeping payment screenshots once a payment is reconciled.
- 5
Learning delivery control breaks
+4 places · 17 so farTeaching happens in a classroom, on an LMS, in live video sessions or all three. The student becomes several parallel records - a roster entry, an LMS login, a video participant.
Where control breaks: AI profiles learners without them seeing it
Moving hereAttendance records· inferred (new at this stage)Marks & performance· inferred (new at this stage)Education & eligibilityPhotos, videos & recordingsBehavioural & learning analytics· inferredDPDPAMap the learner's identifiers across systems, restrict recording access, and set an expiry on session recordings rather than keeping them forever.
- 6
Attendance & engagement control breaks
+2 places · 19 so farAttendance is taken on a register, a biometric device or login telemetry. Engagement, watch history and participation are logged - sometimes on cameras, sometimes as behavioural analytics.
Where control breaks: Biometric attendance of children
Moving hereStudent identityAttendance records· inferredBehavioural & learning analytics· inferredDPDPAUse the least intrusive attendance method, define a CCTV and biometric purpose and retention, and do not publicly display attendance.
- 7
Tests, proctoring & performance control breaks
+2 places · 21 so farTests generate marks, ranks and performance profiles. Online exams may add proctoring - webcam, microphone and browser monitoring - and AI evaluation that infers weak areas and predicts outcomes.
Where control breaks: Proctoring captures a child's face, voice and room
Moving hereStudent identityPhotos, videos & recordingsMarks & performance· inferredBehavioural & learning analytics· inferredDPDPAShare results individually, keep proctoring proportionate and explained, retain human review of AI scoring, and allow correction of an inaccurate record.
- 8
Student & parent communication
+1 place · 22 so farThe institute reaches students and parents through WhatsApp groups, broadcasts, SMS, email and support desks. Numbers, complaints and behavioural notes accumulate in mixed, open channels.
Moving hereStudent identityContact dataMarks & performance· inferredBehavioural & learning analytics· inferredDPDPAPrefer managed groups or broadcasts, keep parent and student channels separate, and never disclose fees, marks or disciplinary detail in an open group.
- 9
Certification & placement control breaks
+2 places · 24 so farCompletion produces certificates, and placement support shares CVs and profiles with employers and internship partners - often across many opportunities without an opportunity-level confirmation.
Where control breaks: Placement profiles sent to employers without confirmation
Moving herePlacement & employability data· inferred (new at this stage)Student identityContact dataEducation & eligibilityDPDPAConfirm each employer share, log the transfer, share the minimum a role needs, and keep certificate records to a minimal verification set.
- 10
Alumni, retention & deletion control breaks
+1 place · 25 so farEverything is kept - admission files, payments, recordings, results, alumni contacts, backups and analytics. There is rarely a retention schedule, and deleting a record from one system misses the copies in the others.
Where control breaks: No retention schedule - and deletion never reaches everything
Moving hereStudent identityEducation & eligibilityID documentsFees & payment dataPhotos, videos & recordingsMarks & performance· inferred+1 moreDPDPASet record-specific retention, wipe devices before disposal, remove former-staff access, and build a deletion path that reaches vendors, backups and analytics.
Top risk hotspots - where control usually breaks
The seven places recruitment agencies most often lose track of candidate data. Each links to the matching check in the readiness assessment.
- Hotspot 1 High risk
Batch and parent WhatsApp groups expose every student's and parent's mobile number to strangers, and photos of students - often minors - circulate and are reused for promotion.
Why this matters
For a minor this is the most sensitive exposure on the map: contact details and images sit in channels the institute cannot control, find or delete, and former students are rarely removed.
Fix: Move to managed broadcasts or a portal on official business accounts, separate parent and student channels, remove inactive members, and never post a child's photo, fees or marks in a group.
Check this in the assessment - Hotspot 2 High risk
The paper admission file collects ID proof, Aadhaar and marksheet photocopies by default and keeps them in an unlocked cabinet with no deletion schedule.
Why this matters
The most sensitive documents are over-collected and over-retained with no access control, so any breach or misuse reaches years of students at once.
Fix: Use a document-requirement checklist, avoid Aadhaar unless genuinely needed, secure the files, and destroy documents on a defined schedule.
Check this in the assessment - Hotspot 3 Critical risk
Online-exam proctoring records webcam video, microphone audio, screen and browser activity, and produces automated 'suspicious behaviour' flags - frequently for minors.
Why this matters
It captures far more than an exam answer, stores it on a vendor platform the institute does not control, and its automated flags can be wrong and impossible for the student to challenge.
Fix: Use the least intrusive assessment that works, document exactly what proctoring captures and for how long, keep human review, and delete raw recordings once the result is final.
Check this in the assessment - Hotspot 4 High risk
AI infers weak topics, predicts dropout and recommends content, creating new profiles of the learner - many of them minors - that the student never sees and cannot correct.
Why this matters
Invisible profiling drives recommendations and interventions, may be reused to train vendor models, and turns behavioural data into decisions about a child with no transparency.
Fix: Keep a derived-data register, explain significant profiling, retain human oversight, restrict training use, and let the student correct the source data.
Check this in the assessment - Hotspot 5 High risk
A fingerprint or face scanner marks attendance, capturing the biometrics of students who are often minors, kept with no defined retention.
Why this matters
Biometrics are collected for a task a register would solve, are stored indefinitely, and belong to children who cannot consent - the parent must, verifiably.
Fix: Use the least intrusive attendance method that works; if biometrics are truly needed, define purpose and retention and take verifiable parental consent.
Check this in the assessment - Hotspot 6 Medium risk
The placement cell shares CVs and profiles with many employers and internship partners, often without confirming each opportunity with the student.
Why this matters
Learner data leaves the institute to third parties with no processing contract, no record of who received what, and no way to withdraw it.
Fix: Confirm each employer share with the student, log every transfer, share only what the role needs, and set retention expectations with the employer.
Check this in the assessment - Hotspot 7 High risk
Admission files, results, recordings, alumni lists, analytics and backups are kept indefinitely, and deleting a student from one system misses the copies in the others.
Why this matters
The institute cannot say where every copy of a former student's data is, keeps it forever by default, and cannot honour a deletion request that must reach vendors, backups and analytics.
Fix: Set record-specific retention, wipe old devices, remove former-staff access, and build a deletion path that reaches vendors, backups and the analytics warehouse.
Check this in the assessment
How to read this journey
Pick your model
Switch between Classroom, Hybrid and Online to see the systems each kind of institute actually uses. Hybrid shows the full picture; classroom and online show their honest subset. The place-counter recalculates for the model you choose.
When it leaves you
A violet left edge and a tag mark systems outside your institute - parents, payment gateways, LMS and EdTech vendors, proctoring platforms, employers and ad networks. Once data lands there your control is indirect: it runs through your contract and instructions, not your admin panel. Risk is shown separately, as an amber or red fill - so an outside system can be low risk, and an in-house one high risk.
Where control breaks
Red flags mark the hotspots - where institutes most often lose control of student data, from children's numbers in WhatsApp groups to proctoring a minor's webcam to a decade of undeleted records. Tap any system to see what it holds and how to fix it.
Now check whether your controls hold up
The map shows where student data travels in a typical institute. The 3-minute readiness scan checks whether your institute has the controls that matter at each hotspot - and the Discovery tool builds your own data inventory.
Educational reference model - not legal advice, and not a scan of your actual systems.