Student Database Management for Schools: What to Store and Who Can Access It
A school student database should contain the information needed for defined school tasks, with an owner for corrections, access limited to assigned work, and a retention decision for each record type. Requirements can vary by record type, board and State/UT, so do not assume one checklist or retention period covers every school.
Scope: The worksheet below is a planning aid, not a prescribed schema or legal checklist. Check current board and State/UT rules for each record your school keeps.
The short answer
- Group information by the school task it supports, such as admission, class placement, attendance or reporting.
- For every field, record its purpose, owner, who can view or change it, and how the school will decide its retention period.
- Before importing a spreadsheet, map its columns, test the mapping, and review duplicates or missing values.
What should a school student database include?
Start with the work the school needs to do, then decide which fields that work requires. Use these examples as prompts; do not add a field just because it appears in a form or another system.
| Record group | Possible examples | Purpose question | Access question | Retention question |
|---|---|---|---|---|
| Admission and identity | School-assigned student number, name, admission or withdrawal status | Which admission, lookup or record-check task needs each item? | Who needs the full record? Who only needs a class list? | Which current board, State/UT or other rule applies to this record? |
| Current enrolment | Academic year, class, section and enrolment status | Which placement, timetable or reporting process uses it? | Who needs to see it, and who is allowed to change it? | What rule or approved review event applies when the record changes? |
| Family and emergency contacts | Parent or guardian contact details; an emergency contact the school uses | Which communication or safety task requires each contact? | Who may view, export or share the details? | How will outdated details be corrected and reviewed? |
| Attendance and learning | Attendance entries, assessment records or report information the school uses | Which educational or administrative workflow uses each record? | Which assigned educators may enter or review it? Which leaders need a summary? | What retention rule applies to this record type? |
| Program-specific identifiers | A UDISE+ PEN or APAAR ID, if the school handles that process | Is the identifier needed for that specific reporting or ID process? | Who handles the process, and can the ID be kept out of routine views? | What official process governs correction or retention? |
| Health or learning-support information | Only details needed for a defined health, safety or learning-support task | Why is each detail needed? Can the task be done with less? | Can access be limited to staff assigned to that task? | Which applicable rule or approved hold determines the review date? |
Make a field-purpose-access-retention register
Before adding a field or importing a spreadsheet, write down:
- Field or record: its plain-language name.
- Purpose: the school task that uses it.
- Authority or reason: the relevant rule, or the internal reason that needs approval.
- Owner: who checks and approves corrections.
- Access: which roles may view, enter, correct, download or share it.
- Retention: the applicable source, review point, any hold, and who approves disposal.
For a spreadsheet move, map each source column to its destination and validation rule. Test with synthetic rows first; compare record counts and flag duplicates or missing required values before transferring live information.
How should staff access be organized?
Give each role access that matches its assigned work. Admissions staff may need admission details; a teacher may need a current class list and relevant learning records; a school leader may need summaries or exceptions. A finance role does not automatically need health notes. A technical operator does not need routine access to read pupil details just to maintain the system.
Decide separately who can view, enter, correct, download or share each record. Review access when responsibilities change, and follow the school’s approved process for recording corrections and exports.
How can schools reduce errors and handle corrections?
Name an owner for the official school record. When a correction is requested, record it, compare it with the source and procedure that apply, update the approved record, then check any report or export that depends on it. Preserve a record when the applicable rule or school process requires it.
For an import, check column meanings, duplicates, missing required values and inconsistent formats. Reconcile totals after the import, investigate exceptions and assign an owner to temporary copies.
How long should a school keep student records?
Decide by record type. Board affiliation, State/UT requirements, financial or examination rules, and a legal or administrative hold may all affect the period. The CBSE Affiliation Bye-Laws, clause 14.19, for example, list admission and withdrawal registers, pupil attendance records, examination material and other documents. The clause says annual examination papers and answer sheets, including internal-assessment records, are kept until the end of September of the next academic year. That endpoint is for the specified examination material; it is not a general period for every student record or every board.
For each record, put the applicable source and review date in the register before setting a disposal date.
Keep APAAR consent specific to APAAR
The APAAR official Resources page currently lists a parental consent/refusal form for APAAR ID generation. That form calls APAAR a voluntary facility, gives a refusal option, and says refusal will not affect admission, promotion or access to government benefits. It also presents consent for listed third-party uses of academic data as a separate optional choice. These statements and choices concern the APAAR process only. The PDF has no visible issue date, so check the current copy before use.
For other school records, document the purpose and applicable authority or approved school process separately.
A practical review before changing the database
- Can the school explain why every field exists?
- Is restricted health, support or identity information separate from routine views?
- Does each role have access suited to its assigned work?
- Is there a named owner for corrections and conflicting source records?
- Have current board and State/UT rules been checked for each record type?
- Do exports and temporary migration copies have an owner and a review decision?
- Are APAAR ID choices recorded for that process only?
When reviewing a school software product, ask the vendor to demonstrate the current fields, access settings, correction history, export behaviour and record close-out process. Verify each point against the product you are evaluating and your school’s requirements.
Official references
- MeitY, G.S.R. 843(E), commencement notification for the DPDP Act, paragraphs (a)–(c).
- MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Rule 1, Rule 8(3) and Fourth Schedule.
- MeitY, S.O. 5458(E), Digital Personal Data Protection (Removal of Difficulties) Order, 2026, dated 5 October 2026; Gazette page dated 6 October 2026.
- APAAR, official Resources page and the English APAAR parental consent/refusal form.
- CBSE, Affiliation Bye-Laws 2018, clause 14.19: Records/Documentation.
- UDISE+ official portal, for the UDISE+ reporting process; this article does not infer that a school ERP must synchronize with it.
Ready to Modernize Your School?
See ManabiApp running on a school like yours. Book a free 20-minute live demo with our team.