How can we help you?

Vidyapeeth360 includes privacy, access-control and governance workflows designed to support a school's programme under India's Digital Personal Data Protection (DPDP) framework. The Act and 2025 Rules are being brought into force in stages; as of August 2026, several substantive requirements have a later commencement date. Schools should check the current commencement notifications and obtain their own advice rather than treating this article as a current-law checklist.

Product controls are not legal certification and do not make a school compliant automatically. Each school remains responsible for its notices, lawful purposes, configuration, vendors, retention decisions and day-to-day operating practice.

Controls available in the product

• Tenant and access boundaries — product routes are designed to enforce the active school, authenticated user and relevant permissions. Treat a missing authorization check in any individual route as a security defect.
• Consent records — supported consent workflows record purpose, status, evidence and withdrawal events. Schools must configure the correct purpose and determine when consent is the applicable ground.
• Purpose and retention controls — administrators can classify data, review retention settings and use governed erasure workflows. Automatic cleanup is deliberately limited and configuration-dependent.
• Breach-response workflow — incident records can track discovery, status and evidence with an internal 72-hour timer. Under the 2025 Rules, affected-person notice and the Board's initial and detailed intimation have distinct timing and content; the product timer does not make that legal assessment or prove notification.
• Access and erasure support — authorised administrators can prepare supported exports and use governed erasure paths subject to identity review and valid retention decisions.
• Audit and authentication controls — role permissions, action evidence and stronger authentication are available for sensitive administration paths. Exact requirements depend on the deployment and configured role.

AI safeguards

The default AI router pattern-redacts common phone numbers, email addresses, Aadhaar, PAN and UPI IDs. Name removal depends on the calling flow supplying known values, so redaction is a configured safeguard rather than a universal guarantee. Current student-AI projections exclude named health, infirmary, wellbeing and counselling sources; that is a verified boundary for those specific flows, not a blanket promise for every integration. School-directed educational and operational indicators are distinct from advertising or cross-site profiling and still require authorised human review.

What a school should review before rollout

1. Confirm which provisions are in force and the lawful purpose, notice and consent path for each enabled workflow.
2. Review who can view, export, correct or erase each class of record.
3. Configure retention, deployment region and vendor/provider dependencies with the school's advisers.
4. Test access boundaries and incident response with representative roles.
5. Re-audit each new AI source or action before enabling it with school data.

FAQ

Does Vidyapeeth360 make a school DPDP-compliant automatically? No. It provides controls designed to support a school's privacy programme. The school remains responsible for current-law review, configuration, lawful use, notices, vendors and operating practice.

Is the 72-hour timer the deadline for every notice? No. It is an internal operational timer. The 2025 Rules distinguish notice to affected people from the Board's initial and detailed information, and the applicable team must review current commencement, content, timing and any extension.

Does the public Aira assistant access student records? No tenant-school context is provided to the public product assistant; it is grounded in public Help Center and marketing content.

Is every identifier removed before every AI call? No universal guarantee is claimed. The default router pattern-redacts common identifiers, while names and source-specific exclusions depend on the governed calling flow.