Campus Data Governance: Who Owns What?

Ask five officers who owns student data and you will get five true and useless answers. The registrar says the university. The controller of examinations says the tabulation room. The librarian says the circulation log is hers. The computer-centre head says the ERP vendor. The IQAC director says NAAC evidence is everyone's. Meanwhile a pilot agent has been given a service account that can read all five stores because the integrator found that easier.

This guide is the map we walk with syndicates before an agent is allowed to retrieve. Ownership in the DPDP sense is not the same as custody, and custody is not the same as a workflow. The university — or the society or the trust the Act names as the legal person — is typically the Data Fiduciary. Officers are not mini-fiduciaries because they have a cupboard. Vendors are processors if the contract and the architecture say so. Students are Data Principals, not 'users of the ERP'.

Not legal advice. Your Act, statutes and the society's registration documents decide the legal person. Write that person down. Then write the cupboards.

Three words the campus keeps mixing up

Fiduciary: who decides why personal data is processed and how. Almost always the university or the registered society, not the vice-chancellor as a natural person and not the computer centre. Joint fiduciaries appear when an affiliating university and a college together decide a purpose — for example a common admissions agent. Write the joint note. Do not leave it as a handshake.

Custodian: who holds the system of record. Controller for marks. Finance for fees. Librarian for circulation. Estates for CCTV. Computer centre for the directory. Custodians do not become owners because they have the admin password. They become dangerous when they think they do.

Workflow owner: who may ask an agent to retrieve a class of record for a named purpose. The chief warden may ask for room occupancy. The chief warden may not ask for semester grades 'to understand the student'. Purpose limitation is the whole game.

A starter map. Your statutes will rename the chairs. Do not skip the last column.

Store	Custodian	Typical workflow owner	Agent may retrieve when
Admission and enrolment	Registrar / dean admissions	Admissions, identity desk	A named admissions or identity workflow, not a marketing twin
Tabulation, marks, revaluation	Controller of examinations	Controller only	Never for a helpdesk or placement agent
Fees, scholarships, vendor payments	Finance officer	Finance, scholarship cell	Reconciliation and status, not credit scoring
Hostel, discipline, ragging files	Student welfare / chief warden	The statutory committee for that file	Facility tickets yes; discipline files no
Library circulation and reading logs	Librarian	Librarian	Hold and fine status; not a reading-profile for placement
Research grants and ethics	Dean research / ethics committee	Those offices	Admin dates and UC packs, not protocol annexes
NAAC / IQAC evidence	IQAC director	IQAC	Evidence that is already designated for that purpose
Directory, logs, backups	Computer centre	None, except operations	The centre is a custodian, not a purpose

The ERP is a building, not a purpose

Campuses buy one ERP and then believe every module is one lawful basis. Fees, hostels, marks and payroll sharing a database is an engineering convenience. It is not permission. An agent with 'ERP read' is an agent with the keys to the college. Split service accounts by workflow. If the integrator says that is hard, the integrator is describing their quote, not the law.

Affiliated colleges make this worse. The university's exam store and the college's attendance store are not one tenant. A multi-tenant design is a later article in this cluster. Here, say only this: a college principal is not entitled to another college's students because they share a vice-chancellor.

NAAC evidence is a purpose. It is not a reason to give IQAC a standing export of every mark and every caste certificate. IQAC gets the indicators the current NAAC template asks for, from custodians, on a calendar. An agent that 'prepares NAAC' by hoovering stores is a breach with a quality vocabulary.

Students, staff, alumni, vendors, minors

Students are principals for their personal data. They are not owners of the mark sheet as a public record the university must keep. Access and correction are DPDP rights once operational duties apply; they are not a right to rewrite a result. Write that sentence into the student notice so the helpdesk agent does not promise a rewrite.

Staff files are employment files. Faculty recruitment screening has its own limits. Do not recycle a student-helpdesk agent onto HR.

Alumni are not students with extra years. The basis for keeping a mobile number to announce a meet is not the basis you used to enrol them. Consent or another live basis, purpose-limited. Vendors on GeM invoices are identifiable too.

Minors appear. Section 9 is not optional because the campus feels adult. Age from admission data, tighter trays, counsel on the live Rules.

The one page that unlocks agents

Before any pilot: legal person as fiduciary; DPO or responsible officer; list of stores; custodian; workflow owners; service accounts; training ban; transfer decision; exit. That page is the governance system. Software can wait.

CERT-In's 28 April 2022 directions still give you a 180-day ICT log floor in Indian jurisdiction. Examination and discipline files will need longer. Write retention by class, not by disk size.

When a store moves, the map is the migration plan

Campuses change ERPs the way they change vice-chancellors: with a ceremony and a year of dual running. Dual running is two processors and two copies. Write which copy is the system of record each week. An agent that retrieves from both and 'reconciles' a mark is inventing a third result. Freeze the agent on a store that is mid-migration, or pin it to one copy.

Backups are not a second purpose. A tape that holds hostel tickets and payroll is still those purposes, sitting cold. Do not give the AI cell a 'backup search' that bypasses the workflow owner. Disaster recovery is a runbook. It is not a new retrieval API for IQAC.

When an officer transfers, the map should name the chair, not the person. 'Dr Mehta's share drive' is how a purpose dies in a retirement. Rename the drive to the store. Disable the personal account. The agent should fail if it can only find Dr Mehta.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

The vice-chancellor owns all data.

The legal person owns the fiduciary duty. The vice-chancellor is an officer. Write the person. Then write delegations. Personality is not a data map.

If we split accounts the agent will be less helpful.

Helpful is how the grade leaked. Helpfulness is a UX word. Privilege is a file word. Choose the file.

Faculty insist their research data is theirs.

Sometimes the IP policy says so for non-personal research artefacts. Identifiable student or patient data in a lab is still the fiduciary's problem. Split artefacts. Do not let a PI's hard disk be the only copy of other people's data, and do not let an agent train on it.

We already have an IT policy from 2014.

Keep the password chapter. Add roles, purposes, processors, minors, training bans and agent verbs. A 2014 acceptable-use note does not know what a retrieval set is.

A two-week ownership map

Do this on paper. Software comes after the names exist.

1. Days 1–3: name the legal person, the DPO or stand-in, and the stores. No tools.
2. Days 4–7: for each store, custodian, workflow owners, retention, whether minors appear.
3. Days 8–10: service-account design for the first three candidate agents. If you cannot split marks from helpdesk, you do not have a first agent.
4. Days 11–14: syndicate note and a student-facing sentence about who holds what. Then talk to vendors.

How this shows up in the file

Attach the map to every AI purchase. The purchase without a map is how the SI names the credential 'integration'. The map is the instruction the processor is bound to.

Revisit when a new ERP module, a new affiliated college, or a new agent workflow appears. Unsigned maps become folklore.

What the next file must contain

“Campus Data Governance: Who Owns What?” earns a line in the noting only if a P3 University can attach proof of “university data governance.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “university data governance.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.

This article is informational field guidance for Indian public universities and colleges, not legal, regulatory, academic, labour or procurement advice. Confirm against the live AICTE / UGC / NAAC notice, the DPDP Act and Rules as commenced, your Act and statutes, reservation orders, labour counsel and the syndicate before you file it.