Sovereignty for Universities Is Different

The syndicate meeting ran long because the registrar and the dean of research wanted opposite things from the same sentence. The registrar wanted no student file to leave the campus data centre. The dean wanted a foundation-model API so a joint lab with a European university could keep pace. Both said sovereignty. They were not talking about the same students, the same purpose, or the same risk.

A ministry is, for all its complexity, usually one fiduciary with a statutory job. A university is at least three institutions sharing a brand. It is a school that holds minors and young adults. It is an employer. It is a research house that begs for collaboration. It also runs hostels, hospitals, exams and placement cells, each of which wants an agent next semester.

This explainer is written for registrars, campus CIOs and university counsel. It does not pretend a campus is a ministry with a cricket ground. It asks you to split the estate before you buy a platform.

Four estates on one campus

One LMS plugin that can see all four estates is a design failure, not a convenience.

Estate	Typical principals	Default posture for agents
Teaching and student life	Students, parents, hostel residents	Local inference; no foreign classroom AI on identifiable work
Exams and evaluation	Candidates, including outsiders	Air-gap or strict on-prem; no training; short, cited retention
Administration and HR	Staff, vendors, applicants	On-prem or Indian private cloud with a transfer table
Research	Subjects, patients, collaborators	Project-level agreements; isolate from the student ERP

The practical rule is boring and unpopular. Do not connect the research GPU cluster to the examination database because a professor asked nicely. Do not let a placement chatbot embed CV folders that include passport numbers. Do not let a hostel complaint agent become a general campus brain.

Students are not users

Product language calls them users. DPDP calls them Data Principals. Many of them are eighteen. Some are not. A click-through in a learning app is a weak story for free consent when the alternative is failing a continuous-assessment component.

There is no Indian FERPA. There is also no licence to improvise one from American blogs. What you have is purpose limitation, a processor contract, security, and rights of access, correction and erasure once operational provisions apply. Exam regulations and UGC or professional-council rules can force retention. They do not force you to send scripts to a US model host.

International students add a second twist. Their home regulator may care. Your DPA with a foreign EdTech vendor may already claim to follow that regulator. Read whether that claim exports Indian student data as the price of a convenient dashboard.

Placement, hospitals and the forgotten estates

Placement cells want an agent that reads every CV and drafts outreach to recruiters. That agent sees passport numbers, caste certificates where students uploaded them for a scholarship that shares a drive, and health disclosures that have no business in a recruiter pack. Treat placement as its own estate with a banned-field list, or it will become the campus-wide leak because it is in a hurry every August.

Campus hospitals and counselling centres are worse if they share an identity forest with the LMS. A clinical note is not a lecture transcript. If the hospital wants an agent, it needs its own fiduciary map, often under additional health-sector expectations that counsel should name. Do not let the CIO’s single platform contract cover a ward.

Alumni offices will ask to fine-tune on decades of student mail. That mail is full of principals who have long since left and never heard of DPDP. Either you have a basis and a retention story, or you have a nostalgia project that should run on public magazine text, not on the inbox.

Objections you will hear on campus

NAAC and rankings require us to look modern. Rankings do not require you to process answer books in a foreign log. Modern can be a local model on the data centre you already boast about in the self-study report.

Faculty will bypass us with personal ChatGPT. Yes. That is an acceptable-use and procurement problem, not a reason to bless the bypass. Offer a sanctioned local assistant for allowed estates so the unofficial path is less tempting. Publish what must never be pasted.

Research dies without the best model. Then buy the best model for the research estate with a project agreement, and keep it off the student ERP. The death of research is not caused by refusing to put hostel complaints into the same context window.

We are a public university, Section 7 covers us. Some functions may sit on a legitimate use. A placement-marketing agent that profiles students for recruiters does not become lawful because the university is public.

Minors, hostels and the parent problem

Undergraduate intakes include people who are not yet eighteen. A hostel complaint agent, a ragging-help line, or a medical-certificate workflow can touch minors. Consent stories get weaker, not stronger. Default to local inference, short retention, and no vendor training. If a parent later asks what the assistant held, you will be glad the write-set list was short.

Hostel wardens will want an agent that reads CCTV notes and late-night gate logs. That is workplace and student monitoring dressed as convenience. Put it in front of counsel before it is a purchase. Many campuses will decide the lawful basis does not exist for an always-on behavioural assistant, and that decision is a sovereignty win even though no GPU was involved.

Parents who live abroad will ask why they cannot use the same classroom tool their child’s cousin uses in another country. The answer is that the university is the fiduciary, not the parent, and that a foreign classroom log is a transfer the syndicate has not accepted for identifiable student work. Write that answer once so every dean does not invent a new one.

A 90-day split of the campus estate

1. Days 1–20: inventory every AI tool in use, including faculty-bought SaaS and student-shared API keys.
2. Days 21–40: assign each tool to one estate. Disconnect anything that spans estates without a written reason.
3. Days 41–65: pick one high-risk estate — usually exams or hostels — and move it to local inference with a write-set list.
4. Days 66–90: syndicate paper: four estates, four postures, one banned list (answer books, counselling notes, medicals, unpublished research identifiable to a person).

What goes in the file

• The four-estate map with owners: registrar, controller of examinations, registrar (admin), dean of research.
• The banned-paste list posted in labs and circulated to faculty.
• Processor contracts for each estate, not one campus-wide click-through.
• The identity diagram that proves research SSO cannot see counselling groups.
• Retention rules for answer books, theses and hostel complaints, cited to the regulation where one exists.

A campus that wants a single agent for everything will eventually put an answer book next to a counselling note. Prcept AI is a better fit when you are ready to run estate-scoped agents on your own metal or private cloud, not when you want one brain for the whole university.

How to defend this in the file

A P3 University will be asked to explain “Sovereignty for Universities Is Different” to a secretary who has ten minutes. Do not start with the model. Start with the store, the hop, the clause, or the residual risk. “university data sovereignty India” is a search phrase. The file needs a decision.

A campus is a fiduciary for students, a workplace for staff, and a research lab that wants to collaborate abroad. One India-region checkbox cannot cover those three jobs. DPDP does not define sovereign AI. Transfers can be lawful and still be a bad idea. Sector circulars can be stricter than DPDP. Write which instrument you are using.

If you cannot name the Data Fiduciary, the processor, the location of traces, and the erasure method, you are not ready for production personal data — whatever the architecture PDF says.

• One sentence on lawful basis or the procurement rule you are invoking.
• One sentence on where prompts, embeddings and logs live.
• One sentence on who can compel the operator.
• One artefact: packet capture, DPA schedule, or deletion certificate template.

Close this loop before the next CAB

Put “Sovereignty for Universities Is Different” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P3 University, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “university data sovereignty India” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.