A school holds more personal information than almost any business in its town. Names and dates of birth of hundreds of children. Their parents' phone numbers, occupations and addresses. Aadhaar details for scholarships, caste certificates for reservations, medical notes for the child with asthma, marks for every exam since nursery, and a fee history that quietly records which families are struggling. In a small town, that register is a map of the community.
For decades it lived in a locked almirah, and the lock was the whole security policy. Today the same information increasingly sits inside software, and that raises a question too few schools ask before they choose a vendor: once our data is in your system, whose is it?
This article answers that question plainly. It covers what India's Digital Personal Data Protection Act means for schools and coaching institutes, what "secure" should mean for a school ERP in concrete terms, and the test every principal should run before signing: can we leave, and take everything with us? Throughout, we explain how LigiLearn, LigimeX's ERP for schools and coaching institutes, handles each point.
The Data Leaks Small Schools Do Not Notice
Before talking about software, it is worth being honest about how school data actually moves today, especially outside the big cities. Rarely through hacking. Usually through convenience.
- A class list photographed on a phone and forwarded to a parents' WhatsApp group, phone numbers and all.
- A pen drive carrying the whole student database from the office computer to a cyber café for printing.
- Marks sent as a spreadsheet to a teacher's personal email, where they stay forever.
- An old office computer sold or given away with the admission records still on it.
- A former employee who still remembers the one shared password everybody used.
None of this is malicious, and none of it is unusual. But every item on that list is a child's information leaving the school's control. Moving to software does not fix these habits by itself. Moving to the right software, with the right rules built in, makes most of them unnecessary, because nobody needs to photograph a list or carry a pen drive when the information is available, securely, to the people entitled to see it.
In a small town, the cost of a leak is also more personal than in a city. Families know one another. A list of fee defaulters forwarded to the wrong group is read by neighbours, and a child's medical note or caste certificate can follow them for years. A school's reputation in its town is built over a generation and can be damaged in one afternoon by a single careless forward. That alone is reason to take data seriously, long before any law asks you to.
What the DPDP Act Changes for Schools
The Digital Personal Data Protection Act, 2023 is India's law on how organisations collect and use personal data. It applies to schools, colleges, coaching institutes and tuition centres just as it does to any business that holds information about people. A full legal analysis is beyond this article, and a school should take proper advice on its own obligations, but three ideas in the Act matter to every principal.
The school is the Data Fiduciary
The Act separates the organisation that decides why and how personal data is used, the Data Fiduciary, from an organisation that processes data on its behalf, a Data Processor. When a school uses an ERP, the school decides what is collected and why, so the school is the fiduciary. The software company processes that data on the school's instructions. This is exactly how LigiLearn's terms are written: the institute is the Data Fiduciary for its student, parent and staff data, and LigimeX is the Data Processor.
This is not just a legal label. It settles the ownership question at the start. The data is the school's, held for the school's purposes, and the vendor has no business using it for anything else.
Children's data deserves extra care
Most of the people in a school's records are children, and the Act treats a child's personal data with additional care, including a requirement for verifiable consent from a parent or lawful guardian. In practice this pushes schools towards being clear with parents about what is collected, why, and who can see it. Software can help by keeping records in one controlled place instead of scattered across phones and spreadsheets, but the school's own admission forms and policies do the explaining.
Collect what you need, protect what you hold
The spirit of the Act is simple: collect personal data for a clear purpose, keep it safe, and do not keep it longer than needed. For a school, that is a good reason to look at the admission form and ask whether every field on it is actually used. It is also a good reason to expect real security from any vendor that holds the data.
We have written a broader, business-focused guide to the Act on this blog: DPDP Act compliance for Indian businesses. This article stays with what is specific to schools and institutes.
What "Secure" Should Mean, in Plain Terms
Every vendor says its software is secure. A principal does not need to be a technical expert to test that claim. It is enough to ask specific questions and expect specific answers. Here are the ones that matter, with LigiLearn's answers alongside.
- Where is our data physically stored?LigiLearn data is hosted on servers in India, with Host IT Smart in Gandhinagar, Gujarat.
- Is it protected on the way?Every connection uses HTTPS, so data is encrypted between the browser or app and the server.
- What if something goes wrong?Backups are taken monthly and stored in India.
- Who inside the school can see what?Access is role-based with fine-grained permissions, so a class teacher sees their class, the fee clerk sees fees, and the principal decides who sees more. Changes to permissions are recorded in an audit log.
- How are passwords handled?Passwords are stored hashed rather than readable, and an account locks after repeated failed sign-in attempts, which stops someone simply guessing their way in.
- Will you ever sell our data?No. LigiLearn does not sell student data.
Notice what these answers replace. Role-based access replaces the one shared password. Data hosted on a server replaces the pen drive and the office computer that might be sold one day. An audit log replaces "I don't know who changed that." Security, for a small school, is mostly the removal of risky habits, and good software removes them without anyone having to remember a rule.
One school, several branches, separate data
School groups that run branches in more than one town face an extra question: should one branch be able to see another's students? Usually not. In LigiLearn, each school or branch gets its own workspace with its own data, set up by the team. A branch in one district cannot accidentally browse the records of a branch in another.
Trust Also Faces Outward: Certificates Anyone Can Check
Data protection is usually discussed as keeping information in. For a school there is a second side: making sure the documents it issues cannot be faked in its name.
A transfer certificate or a character certificate from a small-town school travels a long way, to a school in another state, a college admissions office or a recruiter in a city. Forging one on a computer is not difficult, and a forged certificate damages the reputation of the school whose name is on it.
Every certificate LigiLearn issues, individually or in bulk, carries a QR code. Anyone who receives it can scan the code and confirm on LigiLearn's public verification page that the certificate was genuinely issued. It is a small feature with a large effect: the school's name can be checked rather than merely trusted.
The Exit Test: Can You Leave and Take Everything?
Here is the question that reveals the most about a vendor, and the one most schools never ask: what happens if we want to stop using you?
Some software makes leaving deliberately painful. Data can only be exported in pieces, or in a format nothing else can read. A long contract with a cancellation penalty keeps a school paying for software it no longer trusts. The vendor knows that re-entering years of records by hand is unthinkable for a small office, and prices accordingly.
A vendor that is confident in its product does not need any of that. LigiLearn's position is straightforward:
- The institute owns its data. It is the Data Fiduciary, and the data is held for its purposes only.
- It can export its data at any time, not only on the way out.
- There is no lock-in and no cancellation fee. Cancellation takes effect at the end of the period already paid for.
- It can request deletion when it leaves, so its records do not linger on a vendor's server after the relationship ends.
Run this test on any vendor before you sign. If the answers are vague, slow or conditional, you have learned how the vendor will treat you on a bad day.
Ask the LigiLearn team any of these questions directly, in Hindi or English: book a free demo. Already using LigiLearn? Sign in to your workspace.
Paying for What You Use, Not for Being Stuck
Data ownership and pricing are more connected than they look. A vendor that locks schools in through their data usually also prices them by what they cannot escape. A vendor that lets schools leave freely has to earn the renewal every year.
LigiLearn is priced by the number of active students, meaning those enrolled in the current session on the billing date, with a monthly minimum, and the price is written into the quotation before signing. Alumni, withdrawn students and enquiries are not counted, so the school is never billed for its own history. Every module is in the one plan, setup and training are included, and the only other cost is the Razorpay gateway fee on online fee payments. There is nothing in the pricing that depends on the school being unable to leave.
A Data Checklist for Principals
Print this, or keep it on your phone, for the next time a software company visits your school:
- Is our data stored in India, and with which provider?
- Is every connection encrypted, and how often are backups taken?
- Can we decide which staff member sees which records?
- Is there a record of who changed what?
- Do you ever sell or share our data?
- Can we export everything at any time, and in a usable format?
- Is there a lock-in or a cancellation fee?
- Will you delete our data when we leave, if we ask?
- Who are we under the DPDP Act, and who are you?
Frequently Asked Questions
Who owns student data stored in a school ERP?
The school should. Under the DPDP Act the school decides why and how student data is used, which makes it the Data Fiduciary; the software vendor processes data only on the school's instructions. With LigiLearn the institute owns its data, can export it at any time and can ask for it to be deleted when it leaves.
Where is LigiLearn data stored?
On servers in India. Connections are encrypted over HTTPS and backups are taken monthly and kept in India.
Does LigiLearn sell or share student data?
No. LigiLearn does not sell student data.
Can a school leave LigiLearn and take its data?
Yes. There is no lock-in and no cancellation fee. Cancellation takes effect at the end of the paid period, the school can export its data at any time, and it can request deletion when it leaves.
The Almirah Had a Lock. Your Software Needs More Than One.
Parents in a small town hand a school their children's details because they trust the people in it. That trust does not transfer automatically to whatever software the school chooses. It has to be earned again, through where the data lives, who can see it, and whether the school stays in control of it.
LigiLearn was built to keep that trust where it belongs: with the school. To see how, request a free demo or call +91 90263 45448, Monday to Saturday, 9 AM to 7 PM. For the day-to-day side of the relationship, read how LigiLearn supports schools after the sale.