DPDP Act and face attendance: a consent checklist for colleges and schools
Face data is personal data. A plain checklist for notices, consent (including parents of minors), retention, rights and records.
← All articles · Published 16 Oct 2026 · FaceBiometric team
This article is general information, not legal advice. Check your institution's process with a lawyer.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) applies to digital personal data — and a face template used for attendance is personal data. For a college or school, this mainly means: tell people what you collect and why, get valid consent, keep data only as long as needed, protect it, and respect people's rights. Here is a practical checklist.
1. Who is responsible
The institution decides why and how attendance data is used, so it is the Data Fiduciary. An attendance software provider processes the data on the institution's behalf. The duty to give notice and obtain consent stays with the institution — the software should make it easy to do and to record.
2. Give a clear notice
- What is collected: face template, registration photo, scan photos (if used), attendance times.
- Why: attendance and reports only.
- How long it is kept, and how to withdraw consent or ask for erasure.
- Who to contact with questions or complaints.
3. Get consent from the right person
- Adults (18 or older): the student or staff member consents themselves.
- Under 18: the Act requires verifiable consent of a parent or lawful guardian. Decide this by the date of birth on the consent date — which means keeping dates of birth in your records.
- Make consent specific and freely given: offer another way to mark attendance to anyone who declines.
4. Make parental consent verifiable
When parents live far away (common for hostel students), use their contact details already in your admission records, not a number given by the student now. Practical options:
- A consent link sent to the parent's registered mobile or email, confirmed with a one-time code.
- A signed consent form, photographed or scanned and uploaded.
- A phone call to the registered number, with a written note of who confirmed what.
FaceBiometric records each of these with the date, time, method and the exact consent text shown, so you can show proof later.
5. Keep only what you need
- Delete scan photos after a short period (FaceBiometric: 30 days).
- Delete face data when a student leaves or withdraws consent.
- Never use attendance face data for other purposes, such as marketing or general monitoring.
6. Respect rights
People can ask what is held about them, ask for corrections, withdraw consent and ask for erasure. Keep a simple process: a member's data download in one click, erasure on request, and a record of each action.
7. Protect the data
Encrypt face templates and contact details, give staff only the access they need, keep an audit log, and protect kiosks with their own credentials and locks.
8. When a student turns 18
A parent's consent was given for a child. Once the student is an adult, ask for their own consent — a good attendance system will flag these students for you.
Read more: How FaceBiometric protects data · Privacy policy.
See face attendance working at your campus
A short live demo on your own phone — free.
Book a free demo