Higher Education and the DPDP Act: An Industry Impact Study

Executive summary

Overall impact: High.

This study covers public, private and deemed universities, colleges, IITs, IIMs, foreign university campuses in India and GIFT City, and online degree providers. Entrance coaching appears only briefly; Trayambic's impact study on ed-tech and K-12 schools covers it.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 bring their main duties into force on 13 May 2027. We rate the impact on higher education as High: six of the twelve areas in our scorecard rate High.

Three changes matter most.

• Legal status sets the rulebook. In our view a public university is part of the "State" and can rest core processing on section 7(c), as a function under law. A private university generally cannot, and works from consent or from data students give for a stated purpose. The choice also decides which statutory rights students have, and whether the Right to Information Act, 2005 (RTI Act) applies.
• Every report to government needs a legal anchor. Foreign-student reports under the Immigration and Foreigners Rules, 2025 fit section 7(d), as do credit uploads the institution is bound to make. Voluntary returns such as rankings submissions do not.
• The quieter data needs owners. Counselling notes, hostel CCTV, biometric attendance, placement CVs, alumni lists and research datasets have grown up outside the registrar's office. The institution answers for all of them, and for the vendors holding them.

Some first-year undergraduates are still 17, so section 9 on children applies to them. In June 2026 the Ministry of Education began DPDP briefings for IITs, IIMs and central universities.

Background

The data principals (the people the data is about) are applicants, students, research scholars, online learners, international students, parents, alumni, research participants and staff. The institution is the data fiduciary, which decides why and how data is processed. Vendors acting on its instructions are data processors.

The student record starts with applications and entrance scores, then adds reservation certificates, attendance, scripts, results, hostel, disciplinary and anti-ragging files, fee papers, counselling notes and placement data. After graduation it becomes a verification and alumni record kept for decades.

Data moves in four directions:

• To government: credits and awards to the Academic Bank of Credits (ABC) and the National Academic Depository (NAD) on DigiLocker, against each student's APAAR ID; foreign-student reports; survey and ranking returns.
• To the market: CVs to recruiters, transcripts to employers' verifiers and foreign universities, and leads to and from admissions partners and coaching institutes.
• To vendors: student information and learning systems, examination and proctoring firms, cloud hosts, hostel and security contractors, and online programme partners.
• Into research: surveys, interviews, learning-analytics datasets and, in medical departments, health data and samples.

Foreign campuses often run on their parent's systems abroad.

Legal framework

The DPDP Act and Rules

• Notice and consent (ss.5, 6; Rule 3). An itemised notice; consent that is free, specific, informed, unconditional and unambiguous; easy withdrawal; and s.5(2) notices for consent given before commencement.
• Legitimate uses (s.7). A closed list with no "legitimate interests" ground. Relevant here: 7(a), data voluntarily provided for a specified purpose; 7(c), State functions under law; 7(d), legal duties to disclose information to the State; 7(f), medical emergencies; 7(i), employment. "State" means the State under Article 12 of the Constitution (s.2(zb)).
• Children (s.9; Rules 10 and 12; Fourth Schedule). Anyone under 18 is a child. The Act requires verifiable parental consent and bans harmful processing, tracking, behavioural monitoring and targeted advertising directed at children. Educational institutions are exempt from s.9(1) and 9(3) only for tracking and behavioural monitoring for educational activities or enrolled children's safety.
• Fiduciary duties (s.8; Rules 6 and 7). Responsibility for processors; reasonable security safeguards, with logs kept for a year; breach notice to the Data Protection Board and each affected person, with a 72-hour report; erasure "unless retention is necessary for compliance with any law".
• Rights (ss.11 to 13; Rule 14). Access and correction run only against a fiduciary processing on consent or s.7(a). Grievance redressal applies to all, within 90 days.
• Research and public data. Section 17(2)(b) disapplies the Act for research, archiving or statistics where the data is not used for any decision specific to a data principal and the Second Schedule standards are met (Rule 16). Section 3(c)(ii) excludes data published under a legal obligation.
• RTI (s.44(3)). Since 13 November 2025, s.8(1)(j) of the RTI Act exempts "information which relates to personal information". The public-interest override in s.8(2) remains.

Penalties reach ₹250 crore for security failures and ₹200 crore each for breach notification and children's duties.

Sector instruments

Few of these say how student data must be protected, and the UGC's 2023 foreign campus regulations are silent.

How the laws fit together

Under s.38 the DPDP Act applies alongside other laws and prevails in a conflict. A rule requiring a report or publication supplies a ground (s.7(c) or 7(d)) or the s.3(c)(ii) exclusion; it does not lift duties on security, retention or processors. Section 16(2) preserves stricter transfer laws, but we found none in higher education, so s.16(1) governs and no country is restricted.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Public or private: the ground decides the rulebook

Central and state universities, IITs and IIMs are created by statute and, in our view, are State instrumentalities. Admission, examination and awarding degrees are functions under their founding laws, so s.7(c) covers them without consent. The trade-off: access and correction rights under ss.11 and 12 do not run against s.7(c) processing, so their students rely on the RTI Act and s.13 grievances.

Private universities, private deemed universities and foreign campuses are, in our view, not State instrumentalities. They need consent or s.7(a), which brings full access and correction rights. Government-aided colleges may be RTI public authorities without being clearly "State" for s.7(c), and should document their position.

Answer scripts show the difference. In CBSE v Aditya Bandopadhyay (2011) 8 SCC 497, the Supreme Court held that an evaluated answer book is information under the RTI Act and that an examinee may inspect her own, with examiners' identities masked under s.8(1)(g), for as long as the examining body must keep it (paras 29 and 30). Read literally, the amended s.8(1)(j) could reach a candidate's own script. In our view it should not be used against the person the information is about; the Court found that showing an examinee her own answer book breaches no privacy (para 25). Other candidates' scripts can now be refused more readily, subject to s.8(2).

A private university is usually outside the RTI Act, and s.11 yields a summary, not a copy of a script. Its examination ordinance should set a viewing right and a destruction date.

Under-18 applicants and first-years

Trayambic's article on children's data in schools and ed-tech explains the Fourth Schedule. Three points are specific to universities. First, nothing exempts targeted advertising, so lookalike audiences and retargeting aimed at Class 12 applicants must stop. Second, the education exemption covers tracking and monitoring, not admission files, fees or results. A private university therefore needs verifiable parental consent for a 17-year-old's core record. A public university may rely on Part B (functions under law in a child's interest), though in our view that is untested. Third, hostel entry logs and attendance for under-18s fall within the safety and education exemption. A birthday trigger in the student system should move consent from parent to student at 18.

Reporting to the State: what fits section 7(d)

Immigration. Section 9 of the Immigration and Foreigners Act, 2025 and rule 16 require every institution admitting a foreigner to report in Form II, which replaced the old Form S. Hostel stays also need Form III. This is s.7(d) at its clearest, but processing must follow the disclosing law, so send the Form II fields and no more. The semester entry on "general conduct" is a judgement about a student sent to the State, so record its basis (s.8(3)).

Credits and awards. UGC regulations are subordinate legislation. Where an institution is registered with ABC, or its affiliating university requires uploads, in our view they fit s.7(d), or s.7(c) for a public body. The APAAR order limits onward sharing.

Surveys and rankings. The AISHE portal cites no statute, yet its 2017–18 data capture format, published by colleges, sought each teacher's Aadhaar number, social category and religious community. Check the current format, and ask the Ministry for the legal basis before sending identifiable records. NIRF participation is voluntary, so its faculty list and three-year website hosting are not legal duties, s.3(c)(ii) does not apply, and faculty need notice. Faculty details published under reg 4(1)(h) of the 2023 Grievance Regulations, by contrast, are published under law.

Campus life: counselling, hostels, placement, alumni and online learners

Counselling. Sukdeb Saha requires a counsellor, psychologist or social worker in every institution with 100 or more students. Section 23 of the Mental Healthcare Act, 2017 binds only health professionals treating a person with mental illness, so in our view a social worker's notes may depend on the DPDP Act alone, which has no special category for health data. Keep counselling records outside the student system and anonymise annual reports; crisis disclosure fits s.7(f). For under-18s, the Fourth Schedule's health exemption covers healthcare professionals, so route first-year counselling through one.

Hostels and biometrics. UGC's safety guidelines are advice, not law. Private institutions should take consent at hostel allotment; public ones can argue s.7(c). Keep cameras out of rooms and washrooms, keep footage briefly, and encrypt biometric templates and delete them at exit. Aadhaar-based attendance needs Aadhaar Act consent; give students who decline another method.

Placement. Each recruiter sets its own purposes and is a fiduciary in its own right. Students should opt in company by company, and each recruiter should get only what it needs. Do not publish named salary lists; NIRF needs only aggregates. Point employers' verifiers to NAD records shared from the student's DigiLocker, which Rule 9A of the Digital Locker Rules treats as originals; Trayambic's article on background checks covers the employer's side.

Alumni. Fundraising is a new purpose, so it needs consent; even a public university's s.7(c) cover ends at its statutory functions. Legacy lists built on consent need an s.5(2) notice.

Online learners. The ODL Regulations require identity checks at each assessment and engagement monitoring, but accept any government ID, so do not insist on Aadhaar. Keep online programme partners on processor terms and fix retention for proctoring recordings (covered in the ed-tech study).

Research and ethics committees

Section 17(2)(b) switches the whole Act off for research, but only if the data is not used for decisions about individuals. Learning-analytics "research" that flags at-risk students for intervention fails, as does teaching-evaluation data feeding appraisals.

The ICMR guidelines cover biomedical, social and behavioural research for health. They require privacy and confidentiality (1.1.5), treat hierarchical relationships as a source of vulnerability (2.9.1), which matters when teachers recruit their own students, and expect de-identified sharing (3.3.2). Outside health research we found no statutory ethics-review regime, so the Second Schedule becomes the checklist: lawful purpose, minimal data, accuracy, limited retention, security and accountability. Ethics committees should record whether each protocol relies on s.17(2)(b) and why.

Worked example: two universities, one city

Illustrative. A state university with 200 affiliated colleges and a private university with 9,000 students, 150 of them international, share a city in eastern India.

1. 1.A 17-year-old joins a BSc. The state university records its Part B reasoning and sends a notice to the parent. The private university obtains verifiable parental consent through DigiLocker at admission.
2. 2.A student asks for her script. The state university answers under the RTI Act, masking examiners' initials. The private university adopts a 30-day viewing window in its examination ordinance.
3. 3.An international student drops out. Both file the Form II exit within 24 hours under s.7(d); the private university's hostel also reports her departure under Form III.
4. 4.A placement drive opens. Treating placement as outside any statutory function, both use opt-in consent per company.
5. 5.The alumni office appeals for funds. The state university's alumni association is a separate society, so passing graduates' details to it needs their consent.

The legal routes differ; the practical controls converge.

Compliance framework

Phased roadmap

• Now to December 2026: decide legal status, map grounds and government reports, and pause targeting of minors.
• January to March 2027: rebuild admissions for under-18s; renegotiate vendor and partner contracts.
• April to May 2027: notices, retention, logging, breach drill and rights process.
• Ongoing: review notices each admission cycle, audit vendors yearly, and track the Bill, IFSCA rules and Board appointments.

Recommendations

1. 1.Decide your legal status in writing first; whether s.7(c) and the RTI Act apply shapes everything else.
2. 2.Keep one register of reports and publications, naming the law behind each. Anything without one needs notice or consent.
3. 3.Treat applicants and first-years under 18 as a separate journey, with no targeted advertising and a clear parental route.
4. 4.Put answer scripts under one written rule for viewing, masking and destruction.
5. 5.Ring-fence counselling records from the student system, and route minors' counselling through healthcare professionals.
6. 6.Make placement and alumni uses opt-in, company by company and purpose by purpose.
7. 7.Give research a DPDP gate at the ethics committee.

Key takeaways

• Public universities, IITs and IIMs can rest core processing on s.7(c), but their students then rely on RTI rather than DPDP access and correction rights; private institutions need consent or s.7(a).
• Foreign-student reports under rule 16 and Form II fit s.7(d); AISHE and NIRF submissions need their own legal check.
• Targeted advertising to under-18 applicants is barred, and the education exemption does not cover a 17-year-old's admission or results record.
• Counselling notes outside the Mental Healthcare Act's confidentiality duty, which binds health professionals treating mental illness, rely on the DPDP Act alone; the Supreme Court's 2025 guidelines require anonymised reporting.
• Research escapes the Act under s.17(2)(b) only if no individual decision follows; learning-analytics interventions do not qualify.