Your child's school holds more data than you think
Stop and picture everything your child's school has on file. The admission form had your home address, both parents' phone numbers, your Aadhaar or a copy of it, your child's date of birth, photographs, blood group, and sometimes caste or income certificates for RTE or EWS claims. Add to that years of attendance records, exam marks, medical notes, fee history, and who picks the child up from the gate.
That is a detailed profile of a minor and an entire family. Most parents hand it over without a second thought, because school feels like a safe place. The data usually is handled with good intent. But intent is not the same as protection, and the way a lot of Indian schools store and share this information has quietly become the weak point.
This is not about scaring you. It is about giving you a short, practical checklist so you can ask the school the right questions and judge the answers. The topic of school app data privacy in India has changed a lot in the last two years, partly because of a new law, and parents are right to want clear answers.
Where school data actually leaks
The risks are rarely dramatic. No hooded hacker is targeting your child's spelling-test score. The leaks are ordinary and boring, which is exactly why they keep happening.
- The class WhatsApp group. It is convenient, and it is also a list of every parent's personal mobile number sitting in a group that anyone can screenshot. When a teacher posts the absentee list or a fee-reminder with names, that becomes data nobody can recall. People leave the group, change schools, get added by mistake, forward messages. There is no way to pull anything back.
- The shared Google Sheet or Excel file. Marks, phone numbers, addresses, often in one unencrypted file shared over a link. The link gets forwarded. It sits in five teachers' email inboxes and on a couple of personal laptops with no password.
- The personal phone. A teacher saves 40 parents' numbers in her own contacts. When she leaves the school, those numbers leave with her, on a device the school does not control.
- Paper registers and photocopies. Aadhaar photocopies in an open almirah in the office, attendance registers left on a desk, old admission forms in a cupboard nobody locks.
None of this needs a villain. It just needs an ordinary day and a forwarded message. The fix is not to ban WhatsApp from your life; it is to make sure the school's official record-keeping does not depend on it.
The new rule of the game: DPDPA
In 2023 India passed the Digital Personal Data Protection Act (DPDPA). For the first time there is a national law that says organisations, including schools, must handle your personal data responsibly, collect only what they need, keep it secure, and treat children's data with extra care, usually requiring verifiable parental consent.
You do not need to read the Act. What matters for you as a parent is the shift in mindset it represents. A school can no longer treat "we have always kept it in a register" as good enough. The law expects intention behind how data is collected, who can see it, how long it is kept, and what happens when you ask for it to be removed.
When a school or its software vendor says they are DPDPA-aware, it should mean they have actually thought about these questions and built for them. At AiraNexus we use the phrase carefully and deliberately: it means the platform is designed around these principles, not that we are claiming a stamp nobody can yet issue.
Seven questions worth asking your school
You do not need technical knowledge to ask these. A school that handles data well will have calm, specific answers. A school that does not will get vague.
- Is our data encrypted? Ask whether information is encrypted both when stored ("at rest") and when it travels between the app and the server ("in transit"). The honest answer should be a plain yes, not a blank look.
- Who can see what? A subject teacher should not be able to pull up every family's fee dues and home address. Ask whether access is role-based, so each staff member sees only what their job needs.
- Are there audit logs? If a record is viewed or changed, can the school tell who did it and when? Audit logs are the difference between "we think it's fine" and "we can show you exactly what happened."
- Where is the data hosted? Ask whether it is stored on servers in India. For a law built around Indian residents, India hosting keeps things simpler and closer to home.
- Can data be deleted when my child leaves? When a student moves schools, what happens to their record? You should be able to request deletion and get a clear process, not silence.
- How are parents contacted without exposing numbers? Ask whether teachers message through an official channel rather than from personal phones and open WhatsApp groups.
- Is there a backup, and is it protected too? A daily backup protects against losing data. It should be secured the same way the live data is.
If the answers are clear and specific, that is a good school on this front, whatever software it uses. If they are not, it is a fair thing to raise politely at the next parent meeting.
What "built properly" looks like
Here is how those questions map to how a school platform should actually work, using AiraNexus as the concrete example since this is our blog.
- Encryption is on by default, both at rest and in transit, so a stolen file or intercepted message is not readable.
- Role-based access means the office sees fee data, a class teacher sees her class, and a subject teacher sees only her subject. Nobody gets the whole database by accident.
- Audit logs record who viewed or edited sensitive records, so accountability is built in rather than assumed.
- Parent-teacher chat works without sharing personal phone numbers. Teachers can message a parent one-to-one or broadcast to the class, with read receipts, and neither side ever sees the other's mobile number. That single change removes the biggest everyday leak.
- Daily backups keep records safe from loss, and the data sits in an environment designed around Indian data-protection thinking.
We should be straight with you about one thing. We are DPDPA-aware and we treat ISO 27001 as a goal we are actively working towards, not one we have already certified. It is in progress. We would rather tell you that plainly than imply a certificate we do not yet hold, because the whole point of this article is that you deserve honest answers. You can read more on our safety and security page, and our approach to removing data is described on the data deletion page.
The quiet WhatsApp trade-off
A lot of parents secretly dislike the class WhatsApp group, the constant pings, the forwarded forwards, the awkwardness of leaving it. The privacy angle gives you a cleaner reason to push for change. When school notices, absence alerts, fee receipts, and teacher messages all live inside a proper app, the WhatsApp group stops being the school's filing cabinet and goes back to being just an optional chat.
That is also why unlimited in-app notices and push notifications are free on every AiraNexus plan, with WhatsApp and SMS available only as paid top-ups for the rare urgent broadcast. The default path keeps data inside a controlled space rather than scattering it across personal numbers.
A calm takeaway
Your child's data being safe does not depend on you becoming a security expert. It depends on the school being intentional, and on you asking a few plain questions and expecting clear answers. Encryption, role-based access, audit logs, India hosting, a deletion process, and contact that does not leak personal numbers. That is the whole list.
If you would like to walk through any of this for your own school, or you are a school leader thinking about how to get this right, you can reach us through the contact page. No pressure either way. The most useful thing you can do today is simply ask the questions.