Education door. Rule 11 + UGC + AICTE + NAAC.

DPDP for schools. NAAC for colleges. One platform.

DPDP Rule 11 parental consent, UGC and AICTE filings, NAAC accreditation cycle, NEP reporting, POSH, Labour. Every education regulator, one workspace. Schools, colleges, institutes, universities and EdTech platforms handle the most sensitive data of all: children's. dcomply gives you verifiable parental consent flows, the accreditation cycle tracker, per-campus segmentation for multi-campus institutions, and the grievance workflow every student and parent policy requires.

Children data + parental consent built-in UGC + AICTE + NEP norms No credit card to start
Live Campus Compliance Snapshot
Acme University · 12,400 students
Campus Score: 82/100 GREEN
───────────────────────────────
DPDP Children Data (Rule 11) 91%
UGC compliance ............. 76%
AICTE / NEP norms .......... 85%
NAAC self-study report ..... 88%
Exam data security ......... 94%
───────────────────────────────
Parental consents collected: 11,847 · pending: 553
Sound familiar?

If any of this sounds familiar, you're in the right place.

These are the exact sentences we hear on first calls. If two or three of them ring true, dcomply is the workspace you have been trying to build in a spreadsheet.

You handle minors' data at scale and you don't have a Rule 11 parental consent workflow.

Your NAAC self-study report was a six-month project and you can't remember where the evidence lives.

UGC/AICTE annual returns are prepared by three different people.

Your grievance redressal process is a form on the website with no logged workflow.

If your institution runs a hospital or clinic wing, the Healthcare door covers patient-side obligations.

Your regulator stack

Here's what sits above the foundation.

Educational institutions and EdTech operate under a wider regulator set than most industries. dcomply ships modules for each layer.

Labour codes + POSH
Employee register, PF/ESIC, IC constitution, annual return.
NEP (policy)
Reporting under National Education Policy, curriculum tracking, credit transfer records.
NAAC (accreditation)
SSR structure, evidence library, cycle timeline, peer team visit prep.
AICTE (technical) / UGC (universities)
Annual return, board approvals, evidence archive, faculty declaration.
DPDP Act 2023, Rule 11 (children)
The foundation. Verifiable parental consent, age verification, review scheduler, purpose-scoped processing.
18 years
Child data threshold (DPDP)
100%
Parental consent required
5 years
Student record retention (NEP)
₹250 Cr
Max DPDP penalty
Why Education Compliance is Different

Children Data + Accreditation, All at Once

Children Under DPDP

Verifiable parental consent, no behavioural monitoring, restricted profiling. Rule 11 is non-negotiable.

NAAC / NBA / NIRF

Self-study reports, IQAC records, NIRF data submission. Manual collation eats months.

UGC + AICTE Filings

Annual reports, fee structure disclosure, faculty data, student data, different portals.

EdTech-Specific

If you're EdTech, you also need consent for analytics, in-app data, vendor DPA chains for content partners.

In Your Tenant On Day One

Every Education Module. Pre-Wired

DPDP
Children Data Tracker

Age verification, parental consent capture, profiling restrictions per Rule 11.

DPDP
Consent Management

Multi-form consent for course material, marketing, alumni outreach.

DPDP
DSR Portal

Student / parent right-to-access, correct, delete. SLA tracking.

DPDP
Breach Notification

72-hr DPB notice + 6-hr CERT-In for exam-data leaks.

UGC
UGC Compliance

Annual returns, fee disclosure, faculty data, AISHE submission.

AICTE
AICTE Compliance

Approval renewal, faculty student ratio, accreditation linkage.

NAAC
NAAC SSR Builder

Self-study report data collation across all 7 criteria. IQAC link.

NEP
NEP Implementation

Multi-disciplinary tracker, credit bank logs, ABC integration.

Labour
Labour + POSH

Teaching + non-teaching staff records, POSH IC, annual return.

Vendor
Vendor DPA Chain

Content partners, exam platforms, learning analytics. Sub-processor register.

Security
Exam Data Security

Question paper vaults, OMR data, encryption logs. ISO 27001 control mapping.

Audit
Evidence Locker

One vault: parental consents, NAAC evidence, UGC filings, IQAC reports.

Coverage By Regulator

What dcomply Replaces

Regulator / FrameworkWhy It Appliesdcomply Module
DPDP Act 2023Student personal data + Rule 11 Data Privacy pack + Children Data
UGCUniversities + degree colleges UGC Compliance module
AICTETechnical / management education AICTE Compliance module
NAACAccreditation cycle NAAC SSR Builder
NEP 2020Multi-disciplinary + credit bank NEP Implementation tracker
CBSE / State BoardsK-12 schools Custom regulatory alignment
POSH10+ employees + students POSH IC + annual return
vDPO Addon

Children Data Needs a DPO. We Become One.

DPDP Section 10 plus Rule 11 means most large institutions hit the SDF threshold quickly. A DPO is mandatory.

dcomply vDPO bolts on from ₹2,499/mo. Standard tier adds a monthly human checkpoint. Premium gives you a dedicated advocate-DPO who handles regulator-facing matters.

See vDPO tiers
vDPO Standard₹7,999/mo

AI for the daily work + monthly human checkpoint.

  • Q&A with DPDP + UGC citations
  • Monthly DPO PDF report
  • DSR auto-draft for students/parents
  • Vendor DPA assistant (content partners)
  • 30-min monthly consultation
Built for schools, EdTech & institutes

Children's data is hiding in spreadsheets. We find it.

Admissions in Sheets, fee payments via Razorpay, LMS in MySQL, parent contact in WhatsApp. dcomply maps DPDP Rule 11 exposure across all of them.

MySQL
LMS / SIS scan
LeadSquared
Admissions pipeline
Google Sheets
Rosters & fees
Razorpay
Fee payment PII
WhatsApp Business
Parent communication
Tally
Accounts
Education compliance FAQs

Questions principals, registrars and EdTech founders actually ask.

Any platform processing student data is under DPDP. Because students under 18 are minors, Rule 11 verifiable parental consent applies to the entire user base of a school or K-12 EdTech. Beyond DPDP: NCPCR guidelines, POSH obligations for staff, and GDPR/COPPA if content is sold cross-border.

Rule 11 requires EdTech to obtain parental consent that is verifiable, not a self-declaration checkbox. Acceptable methods include Aadhaar-based e-KYC of the parent, DigiLocker verification, credit-card mini-transaction, or in-person KYC. dcomply supports all four with configurable per-tenant flows.

Only with explicit purpose-scoped consent from the parent (for minors) or the student (if 18+). Consent for "improving our services" is invalid under DPDP because it is not specific enough. dcomply's consent widget supports separate purposes for personalisation, model training and third-party research.

A DPO is mandatory only for Significant Data Fiduciaries. Very large EdTech platforms may be designated SDFs by the DPB. Coaching institutes below that threshold do not require a formal DPO but must still comply with all DPDP obligations. dcomply's virtual DPO service is a cost-effective option.

A student DSR (or parental DSR for a minor) must be honoured within 90 days under Rule 14. dcomply's DSR portal captures the request, verifies the requester via OTP or in-person visit, fans it out to every connected source (LMS, SIS, LinkedIn Learning) via the discovery engine, and produces the export or erasure evidence.

The POSH Act 2013 applies to any workplace with 10 or more employees. Requirements: constitute an Internal Committee, conduct annual training, file annual return by 31 December, display policy prominently, and honour 90-day complaint resolution timelines. dcomply's POSH module handles all of this.

The Rule 11 module supports multiple verification paths: parental Aadhaar (where legally used), verified phone/email, government-issued ID. dcomply keeps the audit trail.

Anonymisation workflows are logged and the module maintains the boundary between identifiable and de-identified data.

Yes. Multi-tenant workspace with campus-level segmentation and roll-up reporting.

Full NAAC cycle from IEQA to SSR to peer team visit, with the standard 5-year evidence window.

New UGC regulations are added as they're notified. The Regulatory Alignment module tracks and applies them.
Real teams, real programmes

"First cycle where we finished a week early."

"NAAC prep used to consume the leadership team for months. Now the evidence is continuously logged and the SSR builds itself. First cycle where we finished a week early."
Registrar, a state university preparing for NAAC re-accreditation.

Start Free. Scale When You're Ready.

Pay-per-module from ₹1,499. Corporate Compliance pack from ₹11,999. vDPO from ₹2,499.