Best DPDP Act–ready school software

Checked against vendor websites on 18 September 2026; DPDP dates checked on 17 September 2026.

iVake publishes this page. Facts about other products come from those companies' own public pages on the date shown. Corrections to hello@ivake.com.

The DPDP Act treats a school like any other organisation holding personal data — except that almost everyone whose data you hold is a child, the group the Act protects most closely. The duties that matter for schools — clear notices and consent, verifiable parental consent, security safeguards, breach reporting and erasure — start in May 2027.

Who publishes a DPDP position

"Not published" means we could not find a DPDP position on that company's own site on 18 September 2026. It is emphatically not a claim that those products are non-compliant — most vendors handle this through a Data Processing Agreement you only see after you ask. The absence of a published position is itself the point: it is something you should have to ask for, in writing, before you sign.

What the DPDP Act asks of you, in practical terms

• Verifiable parental consent for a child's data, and a notice that says plainly what you hold and why.
• A record of processors. Every vendor, gateway and messaging provider that touches student data goes on a list you can produce.
• Erasure. A parent can ask you to delete data; the software has to make deletion real, not a checkbox.
• Breach reporting. You answer to the Data Protection Board, whatever the vendor's SLA says.
• Data location. Where the records live is a question you ask now, not after a breach.

The school exemption in the DPDP Rules covers tracking and behavioural monitoring needed for educational activities and children's safety. It does not cover profiling children for marketing, or passing their data on for someone else's purposes. The full note is at your school as a Data Fiduciary.

What iVake publishes

Hosting in the region your institution is in — India, for Indian institutions — with access set by campus, department and role, and an audit trail that records who changed what and the previous value. That audit trail is the part that turns a DPDP erasure or a breach question from a scramble into a lookup. And we publish a full guide to what the Act asks of your school, linked above, rather than a single "compliant" badge.

What no vendor's page can do for you

• The school answers. A vendor's compliance wording does not transfer liability. If a parent complains, the regulator asks your school first.
• Ask for the DPA, not the slide. The Data Processing Agreement — what the vendor will and will not do with the data — is the document. Get it before signing, and read the clauses on sub-processors and data location.
• Put the AI vendor on the record too. If a helper writes anything using student data, the model provider is a sub-processor. Name it, and decide which categories of data it may touch.

See the audit trail and erasure

The May 2027 duties, one by one

When the main duties start in May 2027, a school has to be able to do five specific things, not just display a policy.

• Notice. Tell a parent, in plain language, what data you hold about their child and why. A privacy policy buried on a website footer does not do this.
• Verifiable parental consent. A child's data needs a parent's consent that you can prove — who consented, when, and for what. A ticked box with no record is not verifiable.
• Erasure. When a parent asks for a child's data to be deleted, the deletion has to be real — across the ERP, the gateways, the messaging providers — not a checkbox that hides a row.
• Breach reporting. If data is compromised, you answer to the Data Protection Board, whatever the vendor's SLA says. The vendor's problem is still your notification.
• Security safeguards. Reasonable security, access limited by role, and the ability to show both to a regulator who asks.

Notice the common thread: all five require the school to be able to show something — a record of consent, a trail of deletion, an access log. That is why the audit trail in the software is not a compliance extra; it is the thing that turns a DPDP obligation from a scramble into a lookup.

The school exemption, and what it does not cover

The DPDP Rules give educational institutions a narrow exemption for tracking and behavioural monitoring that is needed for educational activities and for children's safety. Read it narrowly. It does not permit profiling children for marketing. It does not permit passing a child's data on for somebody else's commercial purposes. And it does not remove the consent, notice and erasure duties — it narrows one edge of the monitoring question. Our full note is at your school as a Data Fiduciary.

The AI sub-processor question

If a helper writes anything using student data — a draft comment, a suggested circular, a quiz question — then the model provider behind it is a sub-processor, and it belongs on your record of processors alongside the ERP, the payment gateway and the SMS provider. Ask three things: which provider, in which country, and whether anything about your students is used to train a model. The vendor that can answer all three in writing is the vendor that has thought about the Act; the vendor that answers "it's all compliant" is the one to read carefully. Our longer note is at AI that stays draft-only.

Frequently asked questions

Sources

• Vendor pages opened and checked on 18 September 2026; none published a DPDP position
• DPDP Act, 2023, section 9 on children and the DPDP Rules, 2025, Fourth Schedule (PDFs)
• iVake: your school as a Data Fiduciary, security and data protection