DPDPA compliance
Last updated: 22 July 2026
The Digital Personal Data Protection Act 2023 ("DPDPA") is the primary Indian law governing personal data. This page explains how Clicknify Schools helps your school stay compliant.
1 · Roles under DPDPA
- Data Principal — the student, parent, or staff member whose data is processed.
- Data Fiduciary — the School. Responsible for lawful processing.
- Data Processor — Clicknify. Acts on documented instructions from the School.
2 · Consent capture
DPDPA requires clear, informed consent from the Data Principal (or guardian for minors) before processing. Clicknify Schools captures consent at:
- Student admission (parent signs consent for their minor child's data).
- Staff onboarding (employee consents to HR data collection).
- Optional communication channels (WhatsApp, SMS opt-in separately).
3 · Notice requirements
Every consent request in Clicknify Schools includes a plain-language notice covering: purpose, data collected, retention period, right to withdraw, contact for grievances.
4 · Right to correction and erasure
Data Principals can request correction of inaccurate data or erasure of their data. Requests should go to the Data Fiduciary (School). The School uses Clicknify Schools's built-in tools to fulfil the request; we support them as needed.
5 · Data breach notification
In the event of a personal data breach, the School must notify the Data Protection Board of India and affected Data Principals. We notify the School within 72 hours of discovery with all the information needed.
6 · Cross-border data transfers
All personal data is stored in India (Supabase Mumbai region + Vercel bom1 region). We do not transfer personal data to jurisdictions outside India without the School's explicit written approval.
7 · Grievance officer
Grievance Officer (India): grievance@clicknifyschool.com. We acknowledge grievances within 3 working days and resolve them within 30 days.
8 · Children's data
DPDPA gives extra protection to children (under 18). Clicknify Schools treats all student data as children's data by default. Behavioural tracking, targeted advertising, and profiling of children are prohibited by law and by our product design.