5 Steps Schools Must Take to Meet DPDPA Section 4 Notice Requirements

Applies to	Schools & Educational Institutions operating in India
Primary law	DPDPA 2023 · Section 4
Penalty ceiling	up to ₹150 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-06
Source	DPDPAReady Compliance Team

Why Schools Cannot Collect Data Without Section 4 Notice

A school in Mumbai collects student names, dates of birth, parent phone numbers, and health records through admission forms—but never tells parents how this data will be used or stored. Under DPDPA Section 4, this oversight can cost the school ₹150 crore in penalties. DPDPA Section 4 is not optional; it is the foundation of lawful data collection in education.

Section 4 requires every school to provide notice to parents and students before collecting personal data. This notice must disclose the school’s identity, the purpose of collection, data retention duration, who may access the data, and the rights the parent or student holds under the Act. Notice is distinct from consent—you must give notice regardless of whether you later seek consent under Section 6.

“A data fiduciary shall provide to the data principal, at the time of collection of personal data, a notice in such form and manner as specified by the Board, containing information about the identity of the data fiduciary, the purpose, and the rights of the data principal under this Act.” — DPDPA Section 4

Failure to provide Section 4 notice exposes your school to regulatory action, enforcement orders, and penalties up to ₹150 crore per violation.

Understanding Section 4 Requirements for Schools

Section 4 mandates that schools provide clear, understandable notice at the point of data collection. For schools, this means:

• Identity: Your school’s name, address, and contact information
• Purpose: Why you are collecting each data element (e.g., “student names for attendance records,” “photos for school magazine,” “health records for emergency response”)
• Retention: How long you will keep the data (e.g., “student records retained for 5 years after exit”)
• Sharing: Who else may access the data (e.g., “shared with state education department for regulatory compliance,” “shared with auditors for financial audit”)
• Rights: That the data principal can access, correct, or request erasure of their data under Section 18
• Redressal: How parents or students can file complaints (e.g., “Contact [name] at [email] or file a complaint with the Data Protection Board of India at [website]”)

Notice must be provided in clear, simple language—not legal jargon—so that a parent with no legal background can understand their rights. DPDPA specifically requires notices to be “comprehensible.”

5 Steps to Implement Section 4 Compliance in Your School

Step 1: Map All Data Collection Points

Conduct an audit of every place your school collects personal data:

• Admission forms: Student full name, date of birth, gender, nationality, parent/guardian names, contact numbers, email addresses, residential address
• Health records: Medical conditions, allergies, emergency contact, vaccination status, blood type
• Academic records: Exam scores, grade sheets, progress reports, attendance records
• Photographs and videos: Student photos for annual magazine, website, social media, school events
• Transport lists: Student name, address, pickup/drop location, emergency contact
• Fee and payment records: Bank account details, parent names, payment history, income details
• Digital systems: Data entered into school management systems, learning management platforms, video conferencing tools
• CCTV footage: If your school operates security cameras
• Counseling or psychological reports: If your school maintains student wellness records

Document each collection point with the name of the data element, the purpose, who collects it, and how often.

Step 2: Identify Who Gives and Who Receives Notice

Not every notice is identical. Classify by data type and collection point:

• Admission notice: Covers collection of name, DOB, parent contact, address at enrollment
• Photo/video notice: Required before collecting images or recordings for any purpose
• Health/medical notice: Covers allergies, medical conditions, emergency contacts
• Digital systems notice: Covers data entered into online platforms or cloud storage
• Ongoing collection notice: For data collected after admission (e.g., new contact number, updated emergency contact)

For minors (under 18), provide notice to both the student and the parent or guardian. If a student is 18 or older, notice to the student alone is sufficient—though notice to parents is best practice.

Step 3: Draft Clear Section 4 Notices in Hindi and English

Create written notices for each data collection scenario. Use simple language, short sentences, and avoid legal terminology. Test your notices with a parent who has no legal background—they should understand it fully.

Template for admission data notice:

Notice Regarding Collection of Student Data

When you enroll your child at [School Name], we collect the following personal data:

• Student name, date of birth, gender, nationality
• Parent/guardian name, phone number, email address, residential address

Why we collect this data:

• To maintain student records and identity verification
• To communicate with you regarding admissions, fees, exams, and school events
• To comply with state education board requirements
• To enable emergency contact in case of illness or accident

How long we keep this data:

• Student records are retained for 5 years after your child exits the school
• After 5 years, records are securely destroyed unless required by law

Who else may access this data:

• State education department (to comply with enrollment mandates)
• School auditors (for financial and compliance audits)
• Government agencies (if required by law enforcement)
• School staff who need the data to perform their duties

Your rights:

• You have the right to access all personal data we hold about your child
• You can request correction of any incorrect information
• You can request erasure of data if we no longer have a lawful reason to retain it
• You can raise a complaint about our handling of data

Complaints: Contact [School Principal Name] at [email] or [phone]. You can also file a complaint with the Data Protection Board of India (www.dpdpboard.gov.in).

Create similar notices for photos, health data, and digital systems. Provide all notices in both Hindi and English.

Step 4: Deliver Notice Before Data Collection

Section 4 requires notice at the time of collection. For schools, this means:

• At admission: Provide the admission notice when the parent submits the enrollment form. Have the parent sign or initial the notice to acknowledge receipt.
• For photos/videos: Provide the photo notice before you take any image or record any video of the student. Include the notice on the photo consent form.
• For health data: Provide the health notice when requesting health information from parents (e.g., on the health declaration form).
• For digital systems: If you later adopt a new school management system or online learning platform, provide notice to all parents within 30 days of adoption, explaining what data will be stored and who operates the system.
• For ongoing collection: When you collect additional data after admission (e.g., a new emergency contact number), provide notice at that time.

Best practice for delivery:

• Admission: Print notice on the admission form; have parent sign the reverse side to confirm receipt
• Photos: Make the photo notice a separate signed form (not just a checkbox on the consent form)
• Health: Attach notice to the health declaration form
• Website: Publish a data notice on your school website stating what data you collect and why
• Email: Email a data protection summary to all parents at the start of each academic year

Do not rely on parents “figuring out” that you collect data. Explicit, written notice is required.

Step 5: Train Staff and Document Compliance

Every staff member who collects or handles data must understand Section 4. Conduct training covering:

• What is Section 4 and why it exists
• Which data collection requires notice
• Consequences of non-compliance (₹150 crore penalty, enforcement action)
• Who is responsible for providing notice
• What to do if a parent says they don’t understand the notice

Create a simple staff checklist:

Data Collection Checklist

• ☐ Do I have a written notice for this type of data collection?
• ☐ Is the notice in both Hindi and English?
• ☐ Is the notice simple and clear, without legal jargon?
• ☐ Have I provided the notice to the parent/student before collecting the data?
• ☐ Have I obtained written acknowledgment that they received the notice?
• ☐ Is the signed notice filed in the student’s record?

Keep records showing:

• Date notice was provided
• To whom (parent or student name)
• Signature or acknowledgment of receipt
• Copy of the notice provided

These records are your evidence of compliance if there is ever a regulatory audit.

Step 6: Update Notices When Data Practices Change

Section 4 compliance is not a one-time exercise. Your notices must stay current with your data practices.

• New data collection: If you start collecting a new type of data (e.g., biometric attendance, parent income for scholarship), create a new Section 4 notice and provide it to affected parents within 30 days
• New third parties: If you engage a new vendor to store data (e.g., a cloud-based learning platform), update your notice to disclose the third party’s name and role
• Change in retention period: If you decide to retain data longer (or shorter), update your notice
• Change in sharing: If you begin sharing data with new organizations, update your notice

At minimum, review all Section 4 notices annually and confirm they match your current practices. If practices have changed but notices haven’t, you are in breach.

Document all updates:

• When the notice was changed
• What was changed
• Why it was changed
• Who approved the change
• When the updated notice was provided to parents

Frequently Asked Questions

Q: Does Section 4 require written consent from parents before I collect data?

A: No. Section 4 requires notice, not consent. You must tell parents what data you’re collecting and why, but Section 4 alone does not require them to sign a consent form. However, if you are collecting data for a purpose beyond your core educational function (e.g., sharing student photos with a third-party publisher), Section 6 (Consent) may apply separately, and you would need explicit consent. To be safe, schools should provide notice in writing and retain a signed copy as proof.

Q: What happens if a parent refuses to enroll after reading the Section 4 notice?

A: That is their choice. Section 4 notice is meant to be transparent—if a parent objects to how you use data, they can choose not to enroll. This is not a compliance failure on your part; you have complied with Section 4 by offering clear notice. Schools should not penalize parents for choosing not to enroll based on data practices.

Q: Can I give notice verbally, or must it be written?

A: The DPDPA does not specify written notice, but written notice is strongly recommended for schools. Verbal notice alone is risky because you cannot prove you provided it if there is a complaint. Best practice: provide written notice (on forms, letters, or email) and retain a signed acknowledgment. This gives you proof of compliance if needed.

Q: Does the notice need to be in English only, or can it be in my local language?

A: Provide notice in both English and the state’s official language (Hindi, Tamil, Telugu, Marathi, etc.). Section 4 requires the notice to be “comprehensible”—this means parents must be able to understand it in their preferred language. If a parent requests notice in a specific language, provide it if possible. For all-India schools, providing notices in English, Hindi, and the local state language is best practice.

Q: If I collect student data through an online school management system operated by a third party (like a SaaS vendor), who is responsible for Section 4 notice?

A: Your school is the data fiduciary and is responsible for providing notice. You cannot delegate this to the vendor. The notice must disclose that your school collects the data and that it is stored by a third-party vendor (name the vendor). You must have a data processing agreement with the vendor that specifies they only use the data per your instructions. Provide updated notice to parents when you onboard a new system, explaining who operates it and how data is protected.