The Digital Personal Data Protection Act, 2023 [1] and the DPDP Rules, 2025 [2] set out how organisations must handle people's digital personal data in India. For education, the definition that matters most is the one for a child: anyone under 18. That covers almost every school student and some first-year college students, and their data needs a parent's verifiable consent.
The main duties start on 13 May 2027 [3]. That date looks distant until you list what has to change first: consent forms, vendor contracts, security logs and the apps already on school devices. The scale is large too, with 24.72 crore students in 14.67 lakh schools in 2025-26 [4].
This explainer sets out what the law requires, what the education exemption covers and what to do before May 2027. It summarises the law; it is not legal advice.
The DPDP Act in Plain Words
The Act works through three roles:
- Data Principal: the person the data is about. For a child, this includes the parents or lawful guardian.
- Data Fiduciary: whoever decides why and how the data is used. In most cases that is the school, college or edtech company.
- Data Processor: a vendor that handles data on a fiduciary's behalf, such as a cloud or LMS provider.
The Act covers data collected in digital form, and paper records once they are digitised, so a scanned admission form counts. It also reaches organisations outside India that offer goods or services to people here.
Two points catch schools out. The fiduciary stays responsible for anything a processor does on its behalf (section 8(1)), and it can use a processor only under a valid contract (section 8(2)). Moving data to a vendor does not move the duty.
Consent is also not the only ground. Section 4 allows processing with consent or for "certain legitimate uses", listed in section 7, which include the State performing a function under law. Not every record needs fresh consent, but every use needs a ground.
When It Applies: The Timeline
The law is coming into force in stages [3]:
| Date | What starts |
|---|---|
| 11 August 2023 | The Act receives assent |
| 13 November 2025 | Rules notified. Definitions, the Data Protection Board and appeals begin |
| 13 November 2026 | Consent Manager provisions begin |
| 13 May 2027 | The main duties begin: notice, consent, security, breach reporting, children's rules and penalties |
A Consent Manager is a registered body that gives people one place to give, manage, review and withdraw consent. Until May 2027, the older regime under section 43A of the Information Technology Act stays in place.
The Data Protection Board exists in law, and the IT Ministry invited applications for a Chairperson and four Members in May 2026. As of 6 November 2026 we could find no notification appointing them. An order of 5 October 2026 made two small wording fixes to sections 9 and 10, which it calls "textual, editorial in nature" [5]. It adds no new duty.
Children's Data: Three Rules
Section 9 sets three rules for anyone under 18:
- Parental consent. Verifiable consent of a parent or lawful guardian before processing a child's data.
- No harm. No processing "likely to cause any detrimental effect on the well-being of a child".
- No tracking or targeted ads. No "tracking or behavioural monitoring of children or targeted advertising directed at children".
Rule 10 explains how a parent is verified. The fiduciary must check that the person "identifying herself as the parent" is an identifiable adult. It can rely on reliable identity and age details it already holds, details the person provides voluntarily, or a virtual token from an authorised entity such as a Digital Locker provider. Note what this tests: the parent's identity, not the child's age. A school with parents' details from admission starts well ahead of an app with only a sign-up form.
The Supreme Court touched the same tension in October. Its order warned that age-based restrictions can require "continuous collection and monitoring of sensitive data" (para 286), and suggested a private-by-default "child mode" for pre-teens "with a reasonable and proportionate means to verify parental consent" (para 301) [6]. Our explainer, Supreme Court on Children's Internet Access: What Schools Must Do, covers what the order asks of schools.
What the School Exemption Covers, and What It Doesn't
Rule 12 and the Fourth Schedule lift the parental-consent and tracking rules in listed cases, each only within its own condition [2]:
- Educational institutions: tracking and behavioural monitoring for the institution's educational activities, or for the safety of enrolled children.
- Crèches and day-care centres: the same, for safety only.
- School and crèche transport: tracking a child's location for safety on the way to and from school.
A second list, open to any fiduciary, covers narrow purposes such as issuing benefits or certificates in a child's interest, creating an email-only account, locating a child in real time for safety, keeping harmful content away from a child, and confirming that a user is not a child.
The limits matter as much as the list. The exemption covers tracking and monitoring for those purposes. It does not cover advertising, and it does not turn every use of student data into a permitted one. The well-being rule in section 9(2) can never be lifted: section 9(4) allows exemptions only from the consent and tracking rules.
What It Means for EdTech Companies
The Act and Rules do not name edtech companies, and whether one can count as an "educational institution" is unsettled. We found no official guidance on it. Commentators lean one way: an October 2026 LiveLaw article argues that direct-to-consumer platforms lack the institutional relationship that would bring them under the exemption, and Dalberg's 2025 note says firms cannot track children's behaviour unless they act as processors for an institution. These are views, not rulings.
In practice, the business model decides where a company stands:
- Selling directly to families: the company is the fiduciary. It needs a working parental-consent flow, and the tracking rule applies in full.
- Working for a school: the contract should make the company a processor acting on the school's instructions. The school stays responsible, and the company should expect tougher questions from schools.
- Advertising: section 9(3) bars targeted ads directed at children, and a parent's consent does not cure that.
The hardest question is learning analytics. Adaptive learning depends on watching what a student does, and neither the Act, the Rules nor any official guidance we found says whether that is "behavioural monitoring". King Stubb & Kasiva's view is that "pedagogical personalisation may be defensible" while commercial profiling is "legally fraught". Until the Board or a court says more, companies should document why each data point serves learning.
There is a real trust gap to close. In the Bharat Survey for EdTech 2025, 63% of children used EdTech, 18% cited a digital privacy or fraud risk, and 10% of those using EdTech had experienced one [7]. In 2022, Human Rights Watch reported that 145 of 163 government-endorsed products (89%) appeared to put children's rights at risk [8]. That is a finding from the pandemic years, not a statement about those products today.
Everyday Duties: Notice, Security, Breaches, Erasure, Grievances
All of these start on 13 May 2027:
- Notice. A clear notice that can be understood on its own, itemising the data, the purpose, how to withdraw consent, the person's rights and how to complain to the Board. It must be available in English or any Eighth Schedule language. For data collected earlier with consent, notice must follow "as soon as it is reasonably practicable" (section 5(2)).
- Security. Rule 6 lists encryption, obfuscation, masking or virtual tokens, access control, logs with monitoring and review, backups and contract clauses for processors.
- Breaches. Rule 7 requires telling each affected person and the Board "without delay". A detailed report goes to the Board within 72 hours of becoming aware, unless the Board allows longer on a written request. The 72 hours applies to that report only.
- Retention and erasure. Data must go once consent is withdrawn or the purpose is no longer served, unless a law requires keeping it (section 8(7)). Rule 8(3) adds a floor: the data, traffic data and logs must be kept for at least a year from the date of processing, for the State purposes listed in the Seventh Schedule, and then erased unless another law requires more. Rule 8's fixed deletion periods and 48-hour warning apply to large e-commerce, gaming and social media platforms, not to education.
- Grievances. Respond within a reasonable period of no more than 90 days, and publish a contact who can answer questions about the data (section 8(9)).
One duty is already live and sits outside this law. CERT-In's Directions of 28 April 2022 require body corporates and Government organisations to report listed cyber incidents "within 6 hours of noticing such incidents", and to keep system logs for a rolling 180 days [9]. Edtech companies and government institutions are plainly covered. A school run by a trust should check where it stands, because the term covers bodies "engaged in commercial or professional activities".
A Data Protection Officer is a legal requirement only for a Significant Data Fiduciary. We found none notified so far.
Penalties
The Schedule to the Act sets these maximums [1]:
| Breach | Up to |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Failing to notify a breach to the Board or affected people | ₹200 crore |
| Breaching the additional duties on children's data | ₹200 crore |
| Breaching a Significant Data Fiduciary's duties | ₹150 crore |
| Breaching any other provision of the Act or Rules | ₹50 crore |
Two further lines cover a Data Principal's own duties (up to ₹10,000) and breach of a voluntary undertaking. The figures are ceilings, not fixed fines. Section 33(2) has the Board weigh gravity, mitigation and proportionality.
APAAR and Student Data
On 20 July 2026, in Abhishek Baxi v. Union of India, the Supreme Court said APAAR data "shall… be strictly governed by the provisions of the Digital Personal Data Protection Act, 2023" [10]. It added that the data "cannot be disclosed, shared, or otherwise made available to any private entity or third party except in accordance with law". It also applied an Orissa High Court direction, to consider adding an opt-out to the consent form, across India.
This was a short order at the first hearing, and the government was given liberty to seek clarification. It issued no direction on admissions. That assurance comes from the Education Ministry's revised form, where a parent declares that refusal "will not affect my ward's admission, promotion, or access to government benefits" [11]. CBSE's registration circular for 2026-27 says: "Filling of APAAR is optional" [12].
The numbers show why this reaches every school: 26.35 crore verified APAAR IDs had been created by 2 July 2026, 16.62 crore of them in schools [13]. Schools should keep a record of each consent or refusal, and should not treat APAAR as compulsory.
What This Means for the Apps Schools Use
Every LMS, ERP, attendance system, CCTV setup and AI tool that touches student data is a vendor question. Ask each one:
- Is there a written contract that makes you our processor, and limits you to our instructions?
- Which student data do you hold, and where is it stored?
- Do you share data with third parties, including analytics or advertising tools inside the app?
- How quickly will you tell us about a breach? The law sets no vendor deadline, but 24 to 48 hours is a common contract term.
- Do you keep logs for at least a year?
- Will you erase or return our data when the contract ends?
- For AI tools: is student data used to train your models?
Biometric attendance and CCTV need a closer look. Both are forms of monitoring, so a school should be able to tie each one to educational activities or student safety, and should say so in its notice.
A Readiness Checklist Before May 2027
- Map what data you hold on students, parents and staff, why you hold it, and where it sits.
- List every vendor and app, and sign a processor contract with each.
- Rewrite notices in plain language, in English and the languages your parents use.
- Set up a process to verify parents and record consent.
- Switch off tracking and ads that fall outside the exemption.
- Put encryption, access control and logging in place, and keep logs for a year.
- Write a breach plan that names who tells parents, the Board and CERT-In, and who writes the 72-hour report.
- Set a retention period for each kind of record, and a way to erase it.
- Publish a contact for data questions, and a way to handle complaints within 90 days.
- Train staff, because most data handling happens at the front office and in the classroom.
Frequently Asked Questions
Does the DPDP Act already apply to schools?
Not its main duties. Notice, consent, security, breach reporting and the children's rules start on 13 May 2027. Definitions and the provisions on the Data Protection Board are already in force.
Who counts as a child under the Act?
Anyone who has not completed 18 years. That includes almost all school students and some first-year college students.
Are schools exempt from parental consent?
Only in part. An educational institution is exempt for tracking and behavioural monitoring done for its educational activities or the safety of enrolled children. Other processing still needs a lawful ground, and the well-being rule always applies.
Can an edtech app show targeted ads to children if parents agree?
No. Section 9(3) bars targeted advertising directed at children, and the Fourth Schedule's education exemptions do not cover advertising.
How fast must a data breach be reported?
Each affected person and the Board must be told without delay. A detailed report must reach the Board within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request.
Does a school need a Data Protection Officer?
Only a Significant Data Fiduciary must appoint one, and we found none notified so far. Every fiduciary must publish the contact details of someone who can answer questions about its data.
Can a school make APAAR compulsory?
The government's own form says refusal will not affect admission, promotion or benefits, and CBSE lists APAAR as optional for 2026-27 exam registration. The Supreme Court has also applied the direction on an opt-out across India.
Can we keep alumni records forever?
No, not by default. Data should be erased once its purpose is served, unless a law requires keeping it, and Rule 8(3) sets a one-year minimum first. Records another law requires you to keep can stay for that period.
References
[1] The Digital Personal Data Protection Act, 2023: https://egazette.gov.in/WriteReadData/2023/248045.pdf
[2] Digital Personal Data Protection Rules, 2025, G.S.R. 846(E): https://egazette.gov.in/WriteReadData/2025/267650.pdf
[3] Notification G.S.R. 843(E), commencement of the Digital Personal Data Protection Act, 2023: https://egazette.gov.in/WriteReadData/2025/267647.pdf
[4] UDISE+ 2025-26 Booklet: https://dashboard.udiseplus.gov.in/report2026/static/media/UDISE+2025_26_Booklet_nep.94ceae1e8c2210549d21.pdf
[5] Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E): https://egazette.gov.in/WriteReadData/2026/276885.pdf
[6] In the Matter of: Just Rights for Children Alliance & Anr. v. S. Harish & Ors., 2026 INSC 1149, Order of 15 October 2026: https://www.livelaw.in/pdf_upload/2026/10/17/just-rights-for-children-alliance-v-union-of-india-707092.pdf
[7] BaSE: Bharat Survey for EdTech 2025: https://www.edtechbase.centralsquarefoundation.org/BaSE%20Report%202025.pdf
[8] "How Dare They Peep into My Private Life?": Children's Rights Violations by Governments that Endorsed Online Learning During the Covid-19 Pandemic: https://www.hrw.org/report/2022/05/25/how-dare-they-peep-my-private-life/childrens-rights-violations-governments
[9] CERT-In Directions under section 70B(6) of the Information Technology Act, 2000, 28 April 2022: https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf
[10] Abhishek Baxi & Ors. v. Union of India & Ors., W.P.(C) 832/2026, Order of 20 July 2026: https://api.sci.gov.in/supremecourt/2026/28929/28929_2026_1_12_72179_Order_20-Jul-2026.pdf
[11] APAAR Parental Consent / Refusal Form: https://cdn-apaar.dl6.in/apaar/consent_form/English_APAAR_Consent_Form_V1.pdf
[12] CBSE List of Candidates circular, 17 September 2026: https://www.cbse.gov.in/cbsenew/documents/LOC_2627_21092026.pdf
[13] Academic Bank of Credits and APAAR, PIB factsheet, 4 July 2026: https://www.pib.gov.in/FactsheetDetails.aspx?id=150693
