Home / DPDP compliance
DPDP Act readiness
DPDP Act compliance for colleges and universities
Your institution holds personal data on every student, parent and staff member. We help you map it, protect it and prove it, ahead of the main duties under the Digital Personal Data Protection Act from about May 2027.
Why it matters
The law applies to every institution that holds personal data
The DPDP Rules were notified in November 2025, and most duties apply 18 months later, from about May 2027. Colleges are data fiduciaries: they decide why and how student, parent and staff data is used, so the duties fall on them, not on their software vendors.
What we deliver
Everything a campus needs to be ready, and to stay ready
Data inventory and mapping
We record what personal data you hold, where it is stored, who can access it and why, across admissions, exams, fees, hostels, libraries and HR.
Notices and consent
Plain-language privacy notices for admission forms and portals, and consent records, including verifiable parental consent for students under 18.
Retention schedules
How long each kind of record is kept, and a safe routine for deleting what is no longer needed.
Processor agreements
Data-protection terms for the vendors that handle your data, from the admission portal to the fee-payment app.
Security safeguards
Access controls, two-step verification, patching, encrypted backups and monitoring: the reasonable safeguards the Act expects.
Breach readiness
An incident playbook, a 24-hour alert and the steps to inform the Data Protection Board and affected people.
Rights and grievances
A simple process for students and staff to see, correct or erase their data, and to raise a grievance.
Independent audits
Formal security audits by an independent CERT-In empanelled auditing organisation engaged for your project, with Cretowin preparing your campus and fixing what the audit finds.
Staff awareness
Short sessions for office, exam and IT staff on phishing, passwords and safe handling of student data.
How it works
From free assessment to a compliant campus
A non-intrusive review of networks, servers, backups, websites and apps, approved in writing and scheduled around your timetable.
A vendor-neutral DPDP gap list for the Principal and management, with priorities and indicative costs.
An annual plan that closes the gaps and keeps records current, scoped and quoted after your assessment.
Partner audits, breach drills and quarterly reports, so you can show your work to regulators and auditors.
Compare plans below. Self-financing institutions can subscribe directly.
Plans compared
What each plan includes
Every plan is scoped and quoted after a free assessment of your campus, and billed quarterly. Government and aided colleges can buy through GeM, open tenders or 3-quote procurement.
| Included | Essential | Standard | Assured | University |
|---|---|---|---|---|
| Preventive maintenance, patching and monitoring | Included | Included | Included | Included |
| Backups with an offline copy | Included | Included | Included | Included |
| DPDP data map and processor agreements | Included | Included | Included | Included |
| Staff awareness session | Included | Included | Included | Included |
| Incident playbook and 24-hour alert | Not included | Included | Included | Included |
| Retention rules and quarterly Principal report | Not included | Included | Included | Included |
| Weekly on-site engineer day | Not included | Not included | Included | Resident engineers |
| Partner vulnerability scans and breach drill | Not included | Not included | Twice a year | Included |
| Campus-wide monitoring and audit coordination | Not included | Not included | Not included | Included |
Official sources and rules tracking
Verify the law yourself
The DPDP Rules were notified in November 2025. Most duties apply 18 months later, from May 2027. We track MeitY notifications and Data Protection Board guidance, and update our consent templates, breach-reporting playbooks and retention schedules when they change.
- MeitY: Data protection framework
- Digital Personal Data Protection Act, 2023 (official text, PDF)
- CERT-In: Indian Computer Emergency Response Team
These links open official Government of India websites in a new tab. Linking to them does not imply any government affiliation, endorsement or certification of Cretowin. See our legal disclaimer.
Find out where your campus stands.
Free, vendor-neutral and with no obligation.