Student Data Under DPDP: University Checklist

The registrar asked for a simple yes: are we DPDP compliant. The IT wing produced a vendor certificate. The examination section produced a server diagram. The hostel office produced nothing, because their real system was a set of WhatsApp groups with scanned ID cards, medical notes and late-night gate logs. A final-year student who had just turned 18 asked, through a teacher, whether she could have her counselling records deleted from 'the AI'. Nobody could find the AI. Everybody could find a folder on a desktop called SCAN_NEW.

This is a checklist for Indian universities and colleges that will process student personal data with or without agents. It is written for registrars, campus DPOs if you have one, and the syndicate member who thinks compliance is a firewall. The Digital Personal Data Protection Act, 2023 regulates digital personal data. MeitY notified the Act and the 2025 Rules on 13 November 2025. The Data Protection Board stood up immediately. Consent-manager provisions apply from 13 November 2026. Most remaining operational duties apply from 13 May 2027. Until those duties commence, the IT Act and the 2011 SPDI Rules remain the live privacy regime. None of that is a holiday from mapping your stores.

It is not legal advice and not a substitute for counsel. UGC, AICTE and NAAC are regulators and assessors with their own live notices — do not invent a current circular from them that 'implements DPDP on campus'. Check what they have actually issued. This checklist is the map we wish every campus already had before the first agent, and before the first unofficial chatbot, saw a mark sheet.

Roles on a campus — say them in one page

The university or college is typically the Data Fiduciary for student, applicant, alumni and often staff personal data it determines the purpose for. A constituent college, an affiliating university, a teaching hospital and a sponsored project can scramble that picture. Write the picture. Joint fiduciaries are not a vibe. They are a sentence two lawyers have agreed.

The ERP vendor, the LMS host, the online-proctoring firm, the cloud mailbox, the payment gateway, the counselling app, and the AI agent vendor are typically processors if they process on your instruction. If any of them decides new purposes — training their model on your essays, selling analytics — they may have stepped out of that box. That is a contract problem, not a footnote.

Students are Data Principals. Parents are not automatically Principals for an 18-year-old. Many first-years are not yet 18. DPDP's child provisions, including verifiable parental consent as the live text requires, are a campus-shaped problem. Build the age gate with counsel. Do not let a hostel clerk invent it.

The stores you are pretending are not stores

ERP and examination databases are obvious. The rest is where you fail. LMS submissions. Email. Shared drives. CCTV clips used in a ragging inquiry. Health-centre notes. Placement-cell spreadsheets. Alumni PDFs. Research-supervisor folders. WhatsApp. Personal Gmail forwards. Unofficial public chatbots. Embeddings and traces of any of the above, once you have an agent.

If an agent will retrieve it, it is in scope. If a clerk will paste it, it is in scope. A store you cannot erase from is a store you should not send personal data to.

Walk this table with one officer from each wing. A blank row is a finding. A 'we will check' is a finding.

Store / pipe	Personal data classes	Fiduciary / processor / unofficial	Erasure / exit method
ERP / student information system	Identity, programme, fees, often category	University + named vendor	Documented; tested on a dummy
Examination and revaluation	Marks, UFM, sometimes medical	Usually university; check outsourced scanning	Retention per ordinance; not 'forever because result'
LMS / proctoring	Submissions, video, keystroke if any	Often a processor abroad or in-country — write it	Contractual deletion; do not assume
Hostel / health / counselling	Medical, disability, discipline, gate logs	Often informal; fix this first	If you cannot name it, stop digitising more into it
WhatsApp / personal mail / public chatbots	Whatever a clerk photographed	Unofficial — not a lawful processor path	You probably cannot erase. Stop the paste.
Agent traces / embeddings	Whatever was retrieved or pasted	University + agent vendor as processor	Must exist before go-live; no training on this data

Classes that need a slower hand

Caste, tribe, income, disability, religion where you hold it, sexual-harassment files, ragging inquiries, medical and counselling notes, biometric attendance, and examination misconduct. DPDP's text does not copy the old SPDI list as a sacred taxonomy, but your own duty of care does not vanish. Purpose must be tighter. Access must be tighter. An agent that can retrieve 'anything about the student' will retrieve these.

Category data exists on Indian campuses because the law of admission and scholarship requires it. That is not a licence to embed it into a general-purpose helpdesk. Separate corpora. Separate roles.

Research data on human participants may already sit under institutional ethics. Do not merge it into the student-helpdesk index because a supervisor thought it would be 'useful context'.

The checklist as a gate, not as a poster

Give the DPO or the officer acting as one a written veto on production personal data in any new agent. Give the CISO a written veto on undeclared egress. Give each wing a duty to keep its row of the store table true. Three signatures. No signature, no connection.

Re-run when a tool is added, when a model is swapped, when a processor changes, when a pilot becomes a programme, and when a WhatsApp group is 'temporarily' used in a strike or an outage.

Until 13 May 2027, someone will say the checklist is early. Early is the point. Stores and habits will not pause for the Gazette.

• Purpose written for each workflow, in ordinary language, filed.
• Lawful basis identified with counsel — consent, legitimate use as the Act allows for the State and others, or another live basis. Do not guess.
• Notice pack drafted for students and, where required, parents of children.
• Processor list with countries, sub-processors, training ban, deletion method.
• Age / child handling written, not improvised at the helpdesk.
• No unofficial public chatbot on live student files.
• CERT-In 180-day logs in India for the official ICT you operate.
• Embeddings and traces on the same erasure map as the source file.

What not to invent while you wait for notices

Do not invent a UGC circular that already 'operationalises DPDP for all HEIs' unless you have the live notice in the file. Check ugc.gov.in.

Do not invent a NAAC metric that awards points for a chatbot. NAAC assesses quality through its live framework. An agent that hallucinates an SSR number is a DVV risk, not a grade booster.

Do not invent a percentage of 'compliant campuses'. You have your stores. That is the only sample that matters.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We are a state university, so we are the State, so we are exempt.

The Act gives the State certain legitimate uses. That is not a general holiday from security, purpose limitation, processor contracts, or the duty to know what you hold. Take counsel. Do not let a corridor theory be your basis.

Our ERP vendor said they are DPDP certified.

Ask what that means, which phase, and whether they train on your data. A certificate is not a role map. You are still the fiduciary for student records you determine the purpose of.

WhatsApp is how the campus actually runs.

Then write it as residual risk and start moving official personal data off it. An AUP plus an official desk path is the beginning. Pretending WhatsApp is not a store is how the inquiry starts.

We will run the checklist in 2027.

Stores you create now will still be there. Processors you appoint now will still hold copies. Run it before the next agent and before the next admission season.

A 30-day campus DPDP walk

Do not start with a 40-slide policy. Start with the store table and the unofficial pipes.

1. Days 1–7: one meeting per wing — exams, admissions, hostel, health, placement, research office, IT. Fill the table. Inventory unofficial tools under amnesty.
2. Days 8–14: name fiduciary and processors with counsel. Draft the child / parent path. Issue the staff AUP on unofficial paste.
3. Days 15–22: pick one agent or one planned agent. Strip its corpus of health, inquiry and category files it does not need. Prove erasure on traces.
4. Days 23–30: syndicate or vice-chancellor note. Veto rights. Dated conditions. The checklist becomes a gate, not a PDF.

How this shows up in the file

The store table, the role map, the processor list, the AUP, and the veto order belong in one folder. That folder is more useful than a purchased 'DPDP pack' with someone else's logo.

Update the table when a tool changes. A checklist dated last admission season is a historical document.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, academic-regulation or engineering advice. Confirm against the current Gazette, DPDP text and Rules, CERT-In direction, India AI Governance Guidelines, UGC/AICTE/NAAC notices, NEP documents, GFR, departmental manual and your counsel before you file it. Guidelines are not statute. Circulars move.