The report positions data protection as both a legal obligation under the Digital Personal Data Protection Act, 2023 and an ethical duty to ensure the safety, dignity, and trust of students, the most valuable stakeholders in education. It translates the provisions of the Act into practical frameworks and actionable guidance tailored to the realities of schools, covering areas such as governance systems, parental consent, data minimisation, vendor management, and breach response protocols. By embedding privacy into everyday practice, Privacy First seeks to move schools from awareness to action, fostering self-regulation and reinforcing parent and community confidence. The report envisions privacy not only as compliance with law but also as a cornerstone of excellence in school governance, helping institutions demonstrate that they are ethical, future-ready, and truly “Student First.”