Alumni data and India’s DPDP Act
· Updated
What does the DPDP Act require of an alumni office?
The Digital Personal Data Protection Act, 2023 governs digital personal data of individuals in India. When your institution decides why and how alumni data is processed, it is the data fiduciary and is responsible for meeting the Act’s obligations, with detailed requirements set out in the DPDP Rules that come into force in phases.
For a typical alumni programme the core duties are: tell alumni what you collect and why, process data for those purposes on a lawful basis (usually consent), keep it accurate, protect it with reasonable security safeguards, report breaches as required, delete it when the purpose is served, and respond to alumni who want to access, correct or erase their data.
| Obligation | What it means for alumni data | How the platform helps |
|---|---|---|
| Notice and consent | Explain what you collect and why before collecting it | Configurable consent checkbox on the registration form; your privacy notice linked from sign-up |
| Purpose limitation | Use data only for the purposes you stated | Separate modules and member-only areas; communication preferences per alumnus |
| Accuracy | Keep records correct and up to date | Alumni can update their own profiles; verification queue for new sign-ups |
| Security safeguards | Protect data against unauthorised access | Row-level security, role-based access, SSO, HTTPS |
| Accountability | Be able to show what was done and by whom | Activity audit trail of admin and staff actions |
| Data principal rights | Respond to access, correction and erasure requests | Profile editing, CSV export for access requests, admin removal of records |
How do we collect consent from alumni?
Turn on the consent checkbox in your registration form settings so alumni must agree to your privacy notice before submitting. Keep the notice short and specific: what you collect (for example name, batch, contact details, employer), why (directory, events, fundraising communications), who can see it, and how to withdraw consent.
When importing records you already hold, treat the first invitation email as a chance to give notice and ask alumni to confirm their details and preferences.
Related: Importing existing alumni records
How do alumni control their own data?
Alumni can edit their profile and choose what other members can see through their privacy settings. Communication preferences let them decide which notifications they receive.
If an alumnus asks for a copy of their data, an admin can export their record; if they ask to be removed, an admin can delete the record. Keep a simple log of such requests and when you handled them.
Related: Notification preferences
What about children’s data?
Schools often hold data about current students. Under the DPDP Act, processing a child’s personal data requires verifiable consent from a parent or lawful guardian, and certain tracking and targeted advertising is restricted. Keep current-student data out of the alumni platform until students graduate and can consent for themselves, or obtain parental consent where you genuinely need it.
What should we do if something goes wrong?
Have a short incident plan: who investigates, how you contain the issue, and how you notify affected alumni and the Data Protection Board as the Rules require. The audit trail helps establish what happened. Tell us immediately if you suspect a problem involving the platform.
Related: Platform security controls
Frequently asked questions
Is Connect My Alumni DPDP compliant?
Compliance is a shared responsibility. Your institution is the data fiduciary and decides how alumni data is used; Connect My Alumni processes it on your behalf and provides consent capture, privacy controls, role-based access, audit logs and exports that support your obligations under the Act.
Do we need consent to import our existing alumni list?
You need a lawful basis for processing, and for most alumni programmes that is consent. A practical approach is to import records, then send an invitation that gives your privacy notice and asks alumni to confirm their details and preferences, removing those who decline.
Can alumni ask us to delete their data?
Yes. Data principals can request erasure once the purpose is served or consent is withdrawn, subject to legal retention requirements. Admins can remove an alumnus’s record from the platform; keep a note of the request and the date you completed it.
Is this legal advice?
No. This page summarises the DPDP Act in general terms to help alumni teams plan. The Act and its Rules are detailed and are being brought into force in phases, so confirm your specific obligations with your institution’s legal counsel.
Put this into practice
Start on the free plan, or book a walkthrough with your own alumni data.