If you operate in an Indian EdTech company, you process personal data of students, parents, teachers, and employees. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), your organisation becomes a Data Fiduciary and is legally responsible for lawful processing and safeguarding of digital personal data.
You don’t need to be a privacy lawyer- but you must implement structured controls.
Here is a practical compliance-oriented checklist.
1) Map the Personal Data You Process (DPDP Requirement)
Under the DPDP Act, organisations must process personal data lawfully, for specified purposes, and with appropriate safeguards.
Start with data visibility:
- List categories of personal data: students, parents/guardians, teachers, employees, vendors.
- Identify systems where data resides: LMS, CRM, ERP, payment gateways, marketing tools, support platforms.
- Record who has access (internal roles and external processors).
- Document purpose of processing for each category.
Maintain this as a living document. It supports:
- Internal compliance checks
- Data access requests
- Regulatory inquiries
- Incident response reviews
Under DPDP, inability to demonstrate responsible handling may increase regulatory exposure.
2) Payment Data Governance
Fee collection involves sensitive financial data.
Best practice under Indian regulatory expectations:
- Use RBI-compliant, established payment gateways.
- Avoid storing full card details internally.
- Restrict dashboard access to authorised finance roles.
- Log refund approvals, fee reversals, and manual overrides.
- Revoke access immediately upon employee exit or role change.
Segregating payment data from academic data reduces operational and breach impact.
3) Maintain Access Controls and Activity Logs
The DPDP Act requires “reasonable security safeguards.”
Practically, this means:
- Role-based access controls
- Multi-factor authentication for admin accounts
- Logs for logins, data exports, modifications
- Monitoring bulk downloads or unusual activity
You do not need an enterprise-grade SIEM from day one, but documented periodic log review demonstrates governance discipline.
4) Backups and Recoverability
Security safeguards under DPDP include resilience.
Confirm:
- Automated backups for critical systems
- Encryption of backups where feasible
- Restricted backup access
- Periodic restoration testing
Ask your tech team to document:
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO)
This is not just operational hygiene, it reduces regulatory scrutiny after incidents.
5) Children’s Data & Verifiable Parental Consent (Critical Under DPDP)
Under the DPDP Act, 2023, children are defined as individuals under 18 years of age.
Key obligations:
- Obtain verifiable parental/guardian consent before processing a child’s personal data.
- Avoid tracking, behavioural monitoring, or targeted advertising directed at children.
- Use clear and age-appropriate privacy notices.
If your product design involves new student features, consult legal before deployment.
Non-compliance may attract significant financial penalties under the Act.
Closing Note
Data protection is not just an IT function. Under DPDP, accountability rests with the organisation. Operations, legal, finance, and product teams all share responsibility.
This checklist is a starting point, not a substitute for formal legal advice or compliance review.
