DPDP Roles, explained simply India's Digital Personal Data Protection Act. Who is who.
DPDP Core · Canonical sector reference

Understand the rule. Stay in the sector context.

Canonical sector reference plus controlled answers to common scenarios. This page covers specific, common scenarios under the notified DPDP framework; it is not an exhaustive ledger of every possible data collection rule.

!Most of this starts on 13 May 2027What is already in force, and what is still ahead

Most of the substantive provisions discussed on this page, including the general obligations, security safeguards, erasure and dormancy rules, and the child data framework, come into force on 13 May 2027.

A small number of provisions commenced earlier, on 13 November 2025: the definitions, the establishment and machinery of the Data Protection Board, and certain procedural powers.

One further stage is still ahead, on 13 November 2026, and it carries only two things: Consent Manager registration under section 6(9), and the Board’s power under section 27(1)(d) to inquire into a breach of a Consent Manager’s registration conditions.

This page is not a complete list of everything an organisation may collect; it only answers specific, common scenarios under the notified framework.

✓Seven things that stay true no matter who is askingYour rights before you even pick a sector. Six answers that no organisation can override.

These do not depend on the sector, on the size of the organisation, or on what you signed. If something you are told contradicts one of these, the thing you are told is wrong.

  1. Agreeing to one thing is not agreeing to everything.Your agreement has to be freely given, specific, informed, unconditional and unmistakable, and limited to the information the stated purpose genuinely needs. The Act's own example: a telemedicine app that also asks for your contact list gets consent only for the telemedicine, because the contact list was never necessary for it.Section 6(1)
  2. You can take it back as easily as you gave it.The ease of withdrawing must be comparable to the ease with which you consented. A one tap yes cannot become a written request by post. Once you withdraw, they have to stop within a reasonable time, and make their vendors stop too.Sections 6(4) and 6(6)
  3. No form can sign away your right to complain.Any part of an agreement that cuts across the Act is invalid for that part. The Act illustrates this with an insurance customer who supposedly waived her right to complain to the Data Protection Board. That waiver is simply void, however clearly it was worded.Section 6(2)
  4. If they say you consented, they have to prove it.Where they were relying on your agreement and the point is disputed, it is the organisation that has to prove you were properly told and that you validly agreed. You are never required to prove that you did not agree.Section 6(10)
  5. When the purpose ends, the data should go.They have to delete your information once you withdraw your agreement, or once it is fair to assume the stated reason has gone, whichever comes first, and make their vendors delete it too. The exception is retention required by law. The reverse also holds: some logs must be kept for a minimum of one year, so deleting early is not always lawful either.Section 8(7), with rule 8(3)
  6. Children cannot be tracked or advertised to.A child is anyone who has not completed eighteen years. A parent has to give verifiable consent before her information is handled at all, nothing done with it may be likely to harm her well being, and tracking, behavioural monitoring and advertising aimed at children are all barred. The narrow exceptions in the Rules can lift the consent and tracking rules in listed situations, and only they can. The ordinary situations where an adult would not have to be asked do not lift the children's rule. Nothing anywhere lifts the harm rule.Section 9
  7. Agreement is one route. It is not the only one.An organisation may act on your agreement, or on one of a short closed list of situations the Act sets out, which covers things like an employer running the job, a medical emergency, a filing the law requires, or a court order. That list cannot be added to except by amending the Act, and marketing, advertising and analytics are not on it. So when a page says something needs your agreement, read it as needing a reason the law recognises, which for anything promotional does mean asking you.Sections 4 and 7
Four terms worth knowing

Data Fiduciary the organisation that decides why and how your personal data is used. Your bank, your school, your employer.

Data Processor a company doing that work on the organisation's behalf, such as a payroll bureau or a cloud host. The organisation stays answerable for it.

Specified purpose the particular reason the organisation told you it was collecting or using your data for. Most limits in the Act are measured against it.

Verifiable consent for a child, agreement given by someone the organisation has actually checked is her parent and an identifiable adult, rather than anyone who ticks a box.

If an organisation gets this wrong, raise it with them first, through the grievance contact they are required to publish. They must respond within a reasonable period not exceeding ninety days. Only after you have exhausted that route may you approach the Data Protection Board.

Selected sector

Schools and Educational Institutions

ACT + RULES

What they may process in practice

Information about a student that the school genuinely needs in order to teach her and to run the place. Because she is a child, the starting point is that a parent has to agree first. Watching and monitoring a child is allowed only for the school's own educational activities, or for her safety.

Why / when

A child here is anyone under eighteen, and the default rule is that a parent has to give verifiable consent before a school handles her information at all. Schools then get one narrow exception. They may track and monitor enrolled children without asking each time, but only for educational activities or for those children's safety.

What they should not assume

The exception covers those two purposes and nothing else. It does not open the door to unrelated uses, and it does not touch the outright ban on advertising aimed at children.

ACT · Sections 4, 6, 9(1) and 9(3); RULES · Fourth Schedule Part A, item 3.

What you may be told, and what the law actually says

You signed the admission form, so we can use your child's data however we need to.

Agreement has to be specific to a stated purpose, and limited to the information that purpose actually needs. An admission form covers admission and education. It does not cover selling the class list, sponsor promotions, or an app the school signs up to two years later. And if the school says you agreed, it is the school that has to prove it, not you who has to disprove it.

The law gives schools an exemption, so we can use children's data as we see fit.

It exempts one narrow thing for schools: tracking and behavioural monitoring, and only for the school's educational activities or the safety of enrolled children. The same list covers a few other situations, such as working out a child's real-time location for her safety and checking whether a user is a child at all. Outside that list, a parent's verifiable consent is still required, and the ordinary situations where an adult would not have to be asked do not lift the children's rule.

We can pass student details to our partner coaching centre or edtech app.

That is a new purpose and it needs a reason of its own. If the partner is handling the data on the school's behalf, rather than for its own ends, the school also has to have a proper contract in place before anything moves.

Showing your child ads is fine because the content is educational.

Advertising aimed at children is barred outright. Nothing in the exemptions brings it back, whatever the advertisement is for.

The provisions behind this sector

Short answers to the questions behind this sector

Common questions

Questions specifically associated with this sector. The complete answer and citation remain in context.

Schools and Educational Institutions

There are two narrow routes, and both are narrower than they look. One covers a transport provider the school has engaged, tracking your child's location for her safety, on the way to and from school. The other covers working out a child's live location where the tracking is limited to her safety, protection or security, and that one is not tied to the school run.

Neither is a permission to track. They only remove the need to ask you first. The school still needs a proper reason to be tracking at all, and neither route covers tracking for something unrelated, or keeping the location history once the safety reason has passed.

ACT · Sections 4, 9(1) and 9(3); RULES · Fourth Schedule Part A item 5, and Part B item 4.

Yes, but only for two things: the school's own educational activities, or your child's safety. Anything else falls outside it.

RULES · Fourth Schedule Part A, item 3.

Yes, as the starting point. A school has to get a parent's verifiable consent before handling a child's information at all.

The Rules then lift that requirement for a short list of situations, and the school one is narrow: tracking and monitoring, for the school's educational activities or for the safety of enrolled children. The same list covers a few other things, such as working out a child's real-time location for her safety, keeping harmful content away from her, and checking whether a user is a child in the first place.

Outside that list, a parent's verifiable consent is still required. This is worth being clear about, because the ordinary situations where an adult would not have to be asked do not lift the children's rule. It is lifted only by that list.

ACT + RULES · Section 9(1); Fourth Schedule Part A, item 3.

No. Advertising aimed at children is banned outright, and so is tracking or behavioural monitoring of children outside the narrow school allowance. The school's exception covers educational activities and safety. Advertising is neither, whatever the advertisement is for.

ACT + RULES · Section 9(3); Fourth Schedule Part A, item 3.

Only with a proper reason for that particular sharing. The school's exemption for children's data is limited to tracking and monitoring for educational activities and safety, so handing information to an outside platform either has to fit inside the Rules' short list of exempt situations, or it needs your verifiable consent.

If the platform is running the service on the school's behalf, rather than for its own ends, the school also has to have a proper contract with it before anything moves.

ACT + RULES · Sections 8(2) and 9; Fourth Schedule Part A, item 3.

Only while there is still a live reason, or while another law requires it. Once your child has left and no legal duty applies, the records should be deleted rather than kept indefinitely.

ACT · Section 8(7).

There is no automatic yearly renewal. What you agreed to stays valid for that purpose until you withdraw it or the purpose is finished.

If the school starts doing something materially new with the data, that is a new purpose, and it has to be asked for again.

ACT · Sections 6 and 8(7).

Not on the strength of the admission form. The school's exception for children's data covers watching and monitoring for its own educational activities, or for your child's safety. Publicity is neither of those.

So publishing your child's picture needs a parent's verifiable consent, asked for specifically, and you can say no to it without that affecting anything else the school does.

There is also a line the school cannot cross whatever anyone agrees to: advertising aimed at children is barred outright.

ACT · Sections 9(1) and 9(3); RULES · Fourth Schedule Part A, item 3.

A school can insist on what it genuinely needs in order to educate your child and look after her. That part is not really a choice for either of you.

What it cannot do is bundle. Agreement has to be specific, and limited to the information the stated purpose actually needs. One tick covering the school's own records, plus a partner app, plus promotional use, is not one agreement. It is several, and only the necessary part stands.

Anything in a consent form that signs away a right the law gives you is invalid on its own terms, whether or not you signed it.

ACT · Sections 6(1), 6(2) and 9(1).

Only for what the app genuinely needs to do the job it was given. Agreement is limited to the information the stated purpose actually requires, and the Act makes the point with its own example: an app that asks both to provide its service and for your contact list gets agreement for the service only, because the contact list was never necessary for it.

Applied to a school app, a permission that the app does not need for what it is actually for does not become allowed just because the form asked and somebody tapped yes.

ACT · Section 6(1) and its Illustration; Section 9(1).