The DPDP Act and AI in Indian schools
India's data protection law treats every student under 18 as a child. Here is what that means when your school brings in an AI tool.
Short answer
Under the DPDP Act, 2023, a school decides how student data is used, so the school is responsible for it, even when an AI vendor processes it. For students under 18 the Act asks for verifiable parent consent and restricts tracking and targeted advertising. Check every AI tool against these duties.
What the DPDP Act is
The Digital Personal Data Protection Act, 2023 is India's law for personal data in digital form. The DPDP Rules, 2025 add the detail and are being brought into force in phases. The Act uses two terms a school should know. A Data Fiduciary decides why and how personal data is used. A Data Processor handles data on the fiduciary's behalf.
When a school chooses an AI tool for its staff, the school is normally the Data Fiduciary and the AI vendor is the Data Processor. The duty to protect the data stays with the school.
The rules for children
The Act defines a child as anyone under 18. That covers almost every school student. Section 9 sets extra duties for the personal data of children.
- Get verifiable consent from a parent or lawful guardian before processing a child’s personal data.
- Do not process data in a way that is likely to harm the well-being of a child.
- Do not track children, monitor their behaviour, or direct targeted advertising at them.
Limited exemptions for education
The Rules give educational institutions limited exemptions for some activities, such as tracking that is needed for educational activities or for the safety of students. These exemptions are narrow. Do not assume they cover a general AI tool. Ask your legal adviser how they apply to your case.
What this means for AI tools
An AI chatbot becomes a data protection matter the moment someone types personal data into it. Three situations need care.
- A teacher pastes student names, marks or notes into a public chatbot.
- A tool builds a profile of how each student behaves or learns.
- A vendor stores your data outside India or reuses it for its own purposes.
A simple checklist for school leaders
Use this list before you approve an AI tool.
- List every AI tool your staff use today, including personal accounts.
- For each tool, write down what personal data goes in and where it is stored.
- Sign a contract with each vendor that limits how they may use the data.
- Check that parent consent covers the way the data is used.
- Decide who in the school handles a data breach and how parents are told.
- Write the rules into an AI policy and train your staff.
How on-premise AI helps
The Act does not say that AI must run inside the school. But when the AI runs on servers the school controls, prompts and answers are not sent to an outside AI company. There are fewer vendors to check and fewer transfers to explain to parents. Bentoboxs AI is built for this kind of deployment.
This page is general information, not legal advice.
See on-premise AI for schoolsFrequently Asked Questions
Short answers to the questions education leaders ask most.
Yes. A school that collects and uses personal data of students, parents and staff in digital form is a Data Fiduciary under the Act and must follow its duties.
Anyone under 18 years of age. This is higher than the age used in many other countries, so it covers almost all school students in India.
It is risky. The school stays responsible for that data, and a personal chatbot account gives the school no contract and no control. A safe rule is that no student personal data goes into a tool the school has not approved.
The Act allows penalties of up to ₹250 crore for the most serious failures, such as not taking reasonable security safeguards. Breaches of the duties for children’s data can also bring large penalties.
Keep reading
More plain guides for leaders of schools and universities.