SCENARIO E01 · CHILDREN & GUARDIANS
A school plans a public student directory with no guardian workflow. What should it assess before publishing?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Whether child-data duties, verifiable parental consent and any Rule 12 exemption conditions apply.
Start with age, purpose, audience, consent and exemption facts; then minimise what any directory reveals.
WHY THE OTHER INSTINCTS MISS
Whether child-data duties, verifiable parental consent and any Rule 12 exemption conditions apply.
Correct. Publishing a directory should not bypass the child-specific analysis.
Publish first because school records are educational.
An educational context does not itself create a blanket exemption from Act section 9.
Ask students to tick an adult-consent box.
A child’s own tick does not establish verifiable consent of a parent under the framework.
BUILD THIS EVIDENCE
Directory purpose assessment, age/guardian facts, Rule 12 check and publication minimisation decision.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- fact-dependent
- Pinpoint
- Act s. 9(1); Rules 10 and 12/Fourth Schedule; G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)