Home/School Compliance in India, The Operator's Guide
The compliance guide
Everything an Indian school must stay compliant with, in one map
Running a recognised school in India means answering to more than parents: the board, the state education department, the Union ministry's data systems and, increasingly, data-protection law. This page maps the whole landscape: what each obligation is, when it bites, and the record-keeping that satisfies all of them at once. It is written for owners and principals, not lawyers.
At a glance
| Item | Detail |
|---|---|
| Portals covered | UDISE+, APAAR, National Scholarship Portal, DigiLocker, DIKSHA, CBSE SARAS/OASIS and Pariksha Sangam, PARAKH: see the portal guides |
| What software can do | Keep the records the filings draw on accurate; export a UDISE+ head-start; issue certificates; keep audit logs |
| What it cannot | File, submit or sync to any government portal: the school signs in and files |
| Data protection | DPDP-aligned handling: encryption in transit, role-based access, per-school isolation, audit logs, backups |
What it looks like
What must an Indian school comply with?
1 · Recognition & affiliation →
State recognition first, then board affiliation (CBSE via SARAS, ICSE via CISCE, or your State board). Renewals and upgradations are diarised obligations, not one-time events.
2 · National data systems →
UDISE+ annual reporting, the PEN for every student, and APAAR: the lifelong student ID. All assume clean, continuously-maintained student records.
3 · Policy alignment (NEP 2020) →
Age-6 Class 1 entry, foundational-stage norms, 50-hour teacher CPD, assessment reform. Direction, timelines and formats flow through your board and state.
4 · RTE obligations
For unaided private schools: the 25% entry-level quota where applicable, state-notified admission processes, and the recognition conditions RTE attaches to elementary education. State rules govern the mechanics.
5 · Data protection (DPDP Act 2023) →
Children's data gets special protection: purpose-limited collection, consent discipline, security safeguards. Your vendors' practices are part of your posture.
6 · Safety & premises
Fire safety, building safety, sanitation and transport norms: certificates that must be valid continuously, plus the safety-policy expectations boards attach (including child-protection requirements).
What one discipline satisfies all six?
Look across the six territories and one pattern repeats: every regulator ultimately asks the school to PROVE something from its records, enrolment that reconciles, teachers whose qualifications are on file, TCs whose serials match a register, fees that match a published structure, consents that were actually collected, certificates that have not expired.
Schools experience compliance as painful when each proof is a reconstruction project. Schools experience it as routine when the records are kept once, continuously, in one system, and every filing becomes a read-out. That is the entire secret, and it is boring: compliance is a by-product of good record-keeping.
When does each compliance task fall due?
Every admission season
Verify the state's current age-cutoff notification; run RTE-quota admissions per the state process where applicable.
Announced annually
UDISE+ data entry window, but the pre-filing reconciliation should be a monthly 20-minute habit, not a fortnight of archaeology.
Before expiry, every cycle
Affiliation extension filings; fire/building/sanitation certificate renewals, diarise with a two-month buffer.
Continuously
OASIS/board data kept current; mandatory public disclosure page on your website kept true; consent records filed; teacher CPD hours logged.
Where does software honestly help?
No software files SARAS, submits UDISE+ or renews a fire certificate for you: anyone implying otherwise is selling. What a school ERP genuinely does is keep the underlying registers reconciled and queryable: one student record feeding enrolment counts, TC serials, fee ledgers and consent files; one staff record holding qualifications and CPD logs.
That is the part Edutris does today, and the UDISE+ export itself has shipped: three CSVs (enrolment by class and gender, the teacher roster and the student master) each carrying a header that names the fields we do not capture. Read it as a head start on the filing, never as filing, which still happens on the portal. If a compliance season is what finally pushes your school off Excel, that is a rational trigger: digitise the records once, and every subsequent filing gets cheaper.
Frequently asked questions
What compliance does a private school in India need?
Six broad territories: state recognition and board affiliation (with renewals), national data systems (UDISE+ annual reporting, PEN, APAAR IDs), NEP 2020 alignment as implemented by your board and state, RTE obligations where applicable, DPDP Act data-protection duties for children's data, and safety/premises certificates kept continuously valid. Each has its own authority and calendar, the common thread is that all of them are satisfied from well-kept school records.
Who is responsible for compliance in a school?
Legally the management (society/trust) and the head of institution certify most filings; practically, well-run schools name one senior owner per territory: e.g. the principal for board matters, a senior administrator for UDISE+/data systems, with a shared compliance calendar reviewed monthly.
Can a school ERP make compliance automatic?
It can make compliance CHEAP, not automatic. Filings still happen on official portals, inspections still happen physically. What an ERP changes is that the numbers and registers every filing asks for already exist, reconciled, in one place. Edutris maintains those registers as part of daily operations, and exports the UDISE+ ones as three CSVs you carry to the portal yourself.
What records do school inspections actually check?
The recurring set: admission and withdrawal registers, TC counterfoils with serial integrity, attendance registers, fee records against the published structure, staff files with qualifications and salary evidence, safety certificates with valid dates, and consistency between what you filed (board data, UDISE+, disclosure page) and what exists on the ground.
Sources
- DPDP Rules, 2025: notified (Press Information Bureau, Government of India), Read 2026-09-11. Records that the Rules were notified on 14 November 2025, giving full effect to the Digital Personal Data Protection Act, 2023, with an eighteen-month phased compliance period. On children: “verifiable consent from a parent or guardian is required… unless the processing relates to essential services such as healthcare, education or real-time safety.”
- UDISE+, official portal (Ministry of Education), The system schools file enrolment, teacher and facility data into, and the origin of the PEN that identifies a student nationally. Login-driven, so the public page carries little beyond the name.
See it running on a real school, in 20 minutes.
Guided onboarding included · Structured setup on your workflow · Tiers from ₹2,999/month
Book a demo →