Is your preschool ready for the DPDP Act?
India’s Digital Personal Data Protection Act applies to every school that holds children’s records. Ten plain questions, an honest answer about where you stand, and nothing to sign up for.
What the DPDP Act asks of a preschool
The Digital Personal Data Protection Act, 2023 is India’s general data protection law. Its rules were notified in November 2025 and the substantive obligations fall due on 13 May 2027. A preschool is a Data Fiduciary under it: you decide why children’s data is collected and how it is used, so the duty is yours and does not transfer to a software vendor.
Children get stricter treatment than adults. Processing a child’s personal data needs verifiable consent from a parent or guardian, and tracking or behavioural advertising directed at children is prohibited outright. In a preschool that touches ordinary things: the photograph in a daily report, the WhatsApp group holding four years of messages, the admission form in a drawer.
- Know what you hold, where it lives, and who can reach it.
- Collect verifiable parental consent, per purpose — a trip is not a photograph on Instagram.
- Be able to show what a parent agreed to, and when.
- Erase a child’s data on request, including from the places you forgot about.
- Name a Grievance Officer and answer complaints within a stated period.
- Tell parents and the Data Protection Board if there is a breach.
The ten questions below check where your school stands against those duties. Nothing is sent anywhere and nothing is stored — the answers stay in your browser.
Full compliance is due 13 May 2027.
The readiness check
Question 1 of 10
Your answers stay in this browser. Nothing is sent to us, and there is no form to fill in to see your result. Read our Privacy Policy if you would like to know how we handle data generally.