DPDP Act for Schools Changes How Admission Forms and Lead Ads Collect a Child’s Data

A parent opens your admission page to ask about Class 1 seats. Before they can speak to a counsellor, the form asks for their child’s name, date of birth, and previous school. They tap “Submit,” expecting a call, not wondering where those details will go next.

Now look at that inquiry from the school’s side. Can your team explain why each detail was collected, who receives it, and what happens when the parent stops responding?

That is the trust question behind your next admission form.

What changes for school admission teams?

13 November 2025 is the notification date printed on India’s Digital Personal Data Protection Rules, 2025. The DPDP Act for schools brings admission forms, lead pages, and follow-up processes into focus wherever they collect and use a child’s personal data.

LexWin’s legal summary identifies 13 May 2027 as the main enforcement milestone, placing preparation within the 2027–28 admission cycle. The Gazette puts Rule 10, which addresses verifiable parental consent, in the eighteen-month commencement group. Schools should have counsel confirm the applicable dates against the official notifications.

Think of your inquiry form as the school gate register. A parent hands over a child’s details for a particular reason. The school needs to explain what it will do with that information and keep its use within the stated purpose. Under the Act, consent-based processing must relate to a specified purpose and be limited to the personal data necessary for it. 

The practical starting point is not a longer form or another generic checkbox. It is reviewing what you collect, how the parent’s agreement is recorded, and where the information goes after submission.

1. DPDP Act for schools: your admission form is a data-collection point

An admission enquiry form is not just a source of leads. When it records information about an identifiable child, it collects that child’s personal data. The Act defines a child as someone below eighteen and includes collection, storage, use, and sharing within “processing.”

School forms may request:

• Child’s name and date of birth.
• Class sought and current class.
• Previous school.
• Parent or guardian’s name.
• Mobile number and email address.
• Residential address.
• Documents, photographs, or health information.

The parent’s contact details are personal data too. An inquiry can therefore contain information about both the adult submitting it and the child seeking admission.

The framework covers information collected digitally and information collected on paper that is later digitized. Moving a handwritten inquiry into a spreadsheet does not take it outside the Act’s scope.

A school that decides why these details are collected and how they are used will generally act as a “Data Fiduciary”: the organization responsible for those decisions. Using an agency, CRM, or form provider does not automatically transfer the school’s compliance responsibilities to that supplier.

The practical starting point is simple: identify the first moment your system collects a child’s details. Do not assume privacy obligations begin only after admission is confirmed. Equally, distinguish preparation now from obligations that commence later under the phased rollout.

2. Verifiable parental consent is stricter than a tick box

Consent must mean more than “the parent submitted the form.”

Section 6 requires consent to be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. It must relate to the stated purpose and be limited to the personal data necessary for that purpose. Section 9 introduces verifiable parental consent before processing children’s data, subject to applicable exemptions.

Rule 10 adds an important verification step. The organization must exercise due diligence to check that the person identifying themselves as the parent is an identifiable adult. The rule describes reliable identity and age details already held, voluntarily provided details, and authorized virtual-token mechanisms, including qualifying Digital Locker arrangements.

For verifiable parental consent, school admission teams should separate three questions:

1. What processing has the parent agreed to?
2. How was that agreement recorded?
3. How was the consenting adult verified?

LexWin’s school-focused summary warns that a blanket statement such as “I consent to the school processing my child’s data” is not, by itself, sufficient verifiable consent.

A better starting point is plain-language, purpose-specific wording. For example:

“I agree to [School Name] using the child’s details listed above to assess this admission enquiry and arrange an admission discussion.”

Keep optional future promotional messages separate from handling the current inquiry:

“I would also like to receive future admission announcements and school event invitations.”

These are drafting examples, not legally approved consent clauses. Separate checkboxes can improve clarity, but the law does not prescribe one universal checkbox layout.

A mobile OTP may help establish control of a phone number; do not treat it alone as proof of adulthood or parental status. Have counsel and your technology provider approve the verification process before child data collection begins.

3. Admission forms often collect more than the enquiry needs

A first inquiry and a completed admission application serve different purposes. Your forms should reflect that distinction.

Section 6 limits consent-based processing to personal data necessary for the specified purpose. That gives schools a practical reason to review every field rather than copy last year’s application form into this year’s landing page.

Apply a keep, move, or drop test:

Field	Suggested inquiry-stage decision	Question to resolve
Parent’s name and contact number	Keep	Are these needed to respond?
Class sought	Keep	Does this establish the relevant admission pathway?
Child’s full name	Review	Can the first conversation happen without it?
Exact date of birth	Review or move	Is exact age eligibility being checked now?
Previous school	Move unless needed.	Does it affect the initial response?
Full address	Move unless needed.	Would locality be enough initially?
Birth certificate or identity document	Move unless necessary.	Why is document verification required at the enquiry stage?
Health details or photographs	Drop from initial inquiry unless justified.	What immediate purpose requires them?

These are suggested audit decisions, not statutory classifications. Your school’s admission requirements may justify a different approach.

For each retained field, document:

• Why it is needed.
• Who can access it.
• Which vendors receive it.
• How long it must remain available.
• What happens when the enquiry closes.

If the first task is simply arranging a parent conversation, consider an adult-only initial inquiry. Collect the child’s details later through an appropriate process.

This does not remove responsibilities for the parent’s data. It reduces unnecessary child-data collection before the school actually needs it.

4. Lead ads and retargeting need a second look

The DPDP Act does not ban all school advertising.

Section 9 prohibits tracking or behavioral monitoring of children and targeted advertising directed at children, subject to prescribed exemptions. Advertising aimed at adult parents is therefore a different question from advertising directed at children.

However, “we target parents” is not a complete school lead ads data privacy assessment. The school must also understand the information entering its advertising systems.

Review these situations:

• A lead ad asks an adult parent for the child’s name and date of birth.
• A landing-page pixel receives information from form submissions.
• A student-facing page contributes visitors to a retargeting audience.
• An agency uploads admission inquiries or enrolled student lists.
• A conversion event contains identifiers or details relating to a child.

Do not assume that a child-specific page proves its visitor is a child. Equally, do not assume every visitor is an adult parent. Review the audience, the data collected, and the actual tracking configuration.

The Fourth Schedule’s educational-institution exemption is limited. Its wording covers processing restricted to tracking and behavioral monitoring for the institution’s educational activities or the safety of enrolled children. It is not a blanket exemption for admissions, marketing, or advertising.

Parental consent also does not automatically authorize an activity prohibited by Section 9.

Before the next campaign launches, ask counsel to review your targeting, audience uploads, and child data processing. Ask the agency to show which tags fire and what they transmit. A privacy policy cannot correct an advertising setup that sends information beyond the approved purpose.

5. WhatsApp and call follow-up need recorded permission

A parent asking for admission information does not necessarily agree to every future campaign.

Separate responding to the current inquiry from optional promotional outreach. Where consent is the processing basis, the school should be able to prove that it supplied the notice and obtained valid consent. Withdrawal must be comparably easy to giving consent. 

For each inquiry, record:

• The submission date and source.
• The notice and consent wording shown.
• The purposes accepted.
• The communication channels selected.
• The child-data verification status, where applicable.
• Any later withdrawal or contact restriction.

An operational example might read:

“You may contact me by phone and WhatsApp about this admission enquiry, including admission requirements and campus-visit arrangements.”

Do not treat this sample as a complete legal solution. Counsel should assess the processing basis, and the team must separately check applicable platform and communications requirements.

Provide a straightforward stop option, such as “Reply STOP to stop admission follow-up messages.” Make sure it reaches every relevant counsellor and automation, not just the person reading the reply.

Skyram Next’s explanation of school admission marketing services places WhatsApp follow-up within the admission process. That follow-up system should carry the parent’s permissions and restrictions alongside the inquiry details. 

Avoid adding parents to groups that unnecessarily expose their numbers or circulating child data spreadsheets through informal chats. A permission record is useful only when the team follows it.

6. A 30-day DPDP checklist for admission season

The DPDP Rules 2025 schools need to prepare for affect forms, vendors, notices, and everyday staff behavior. Use the following thirty-day plan as an implementation starting point, not a compliance certificate.

Week 1: Map every form, pixel, and list.

Create one inventory covering website forms, advertising-platform forms, downloadable applications, open-house registrations, and paper inquiries.

Follow each enquiry into the CRM, shared spreadsheet, email inbox, counsellor account, and agency export. Include old lists still used for campaigns.

Ask IT or the agency to inspect tags, pixels, and conversion events. Record the data each tool receives and its purpose.

Assign an owner to every collection point. Identify which forms collect a child’s information and which could initially collect only adult-parent details.

Deliverable: a map showing where information enters, travels, and remains.

Week 2: Rewrite notices and consent flows

Replace vague wording with an itemized explanation of the data and purposes. Rule 3 requires a clear, standalone notice that explains relevant personal data, purposes and routes for withdrawal, rights and complaints. 

Separate current-enquiry handling from optional future promotions. Remove preselected consent choices.

Design the adult-verification step with counsel and IT. Check whether the form saves drafts, captures partial entries, or transmits child-data events before the intended consent step.

Test the notice on a phone. Parents should not need to search through an unrelated admissions document to understand the choice.

Deliverable: approved wording and a technically tested collection flow.

Week 3: Set retention, access, and deletion rules.

Separate active inquiries, closed inquiries, admitted-student records, promotional contacts, and required compliance records.

Do not choose one arbitrary deletion period for everything. The Act addresses erasure when consent is withdrawn or the purpose ends, while the Rules include specific retention requirements, including Rule 8(3)’s minimum one-year retention provision for specified purposes. Have counsel reconcile these requirements before scheduling deletion. Restrict access by role. Review vendor contracts, exports, backups, and deletion responsibilities.

Deliverable: an approved retention schedule, access matrix, and deletion process.

Week 4: Train counsellors and test the complete journey.

Train staff to recognize contact restrictions, record withdrawals, and escalate privacy requests.

Use dummy information to test:

• A parent making an inquiry.
• A parent declining optional marketing.
• A parent requesting no further calls.
• A withdrawal reaching all connected systems.
• A closed inquiry reaching its approved retention deadline.

Check the vendor and agency side too. Section 8 keeps the school responsible for processing undertaken on its behalf and requires valid contracts with processors. 

Deliverable: a completed test record and a list of unresolved issues with named owners.

7. What this post cannot tell you

This guide cannot determine your school’s precise legal position, approve a verification provider, or decide whether a particular advertising audience is lawful.

The 13 May 2027 milestone appears in LexWin’s secondary summary. The official Gazette states the phased commencement periods; schools should verify the date against applicable notifications and any subsequent changes.

Do not adopt a penalty figure from a headline. Financial penalties are set in the Act’s Schedule and require checking the relevant provision and current text. Children’s data protection schools in India need an operational responsibility, but school-specific legal interpretation belongs with qualified counsel.

Frequently asked questions

1. Does the DPDP Act apply to private schools?

Yes. A private school processing digital personal data will generally fall within the framework, and a school deciding why and how admission information is processed acts as a Data Fiduciary. This includes paper information subsequently digitized. A lawyer should confirm the school’s position, applicable exemptions, and commencement requirements rather than assume every activity receives identical treatment.

2. When do the DPDP Rules apply to schools?

The rules were notified on 13 November 2025 and commence in phases. LexWin’s summary identifies 13 May 2027 for the main enforcement milestone, including parental-consent preparation. The Gazette places Rule 10 in the eighteen-month commencement group. Confirm the operative date in the Gazette and applicable notifications with counsel before fixing your school’s compliance deadline.

3. Do schools need parental consent for an admission enquiry form?

Generally, yes: once the relevant provisions commence, processing a child’s personal data requires verifiable parental consent unless an applicable exemption covers that processing. For an inquiry form, review the child-data fields, notice, consent record, and adult-verification step before collection. Do not assume the education exemption automatically covers admissions; ask counsel to assess the particular flow.

4. Can a school run retargeting ads under the DPDP Act?

Potentially, yes; the Act does not prohibit every retargeting campaign. It prohibits targeted advertising directed at children and restricts tracking and behavioral monitoring of children, subject to prescribed exemptions. Review the audience’s age, the data feeding it, pixel configuration, and uploaded lists. Obtain counsel’s assessment rather than treating all parent-focused retargeting as automatically lawful or unlawful.

5. What are the penalties under the DPDP Act?

The Act provides for significant financial penalties set out in its Schedule. The relevant ceiling depends on the obligation breached; there is no single universal “school penalty.” Check the current schedule before quoting amounts, and ask counsel how the provisions could apply to your institution. This guide deliberately avoids presenting unverified figures as school-specific exposure.

Check your admission forms before May 2027

Preparing for the DPDP Act for schools starts with the next inquiry, not just the final admission file.

Review the fields parents complete, the permissions they give, the systems receiving their information, and the follow-up that follows. A clear notice and a checkbox are useful only when verification, access, advertising, and retention processes support them.

Check your forms and lead pages before the May 2027 milestone, with legal review of the applicable requirements.