DPDP Act for Schools, Colleges & EdTech: Compliance Guide
Schools, colleges, coaching institutes and edtech platforms process the personal data of millions of children and young adults: admissions, attendance, marks, fee records, photos, CCTV footage and learning behaviour. Because so many students are under 18, the children's-data rules matter more here than in almost any other sector.
Under the Act a child is anyone under 18, and processing their data normally needs a parent's or guardian's verifiable consent, with no tracking, behavioural monitoring or targeted advertising aimed at them. The Rules give educational institutions a limited exemption for tracking and monitoring that serves educational activities and student safety. Edtech platforms that sell, advertise or profile get no such comfort. Most duties take effect on 13 May 2027.
Who this covers
Schools are Data Fiduciaries for student, parent and staff data, and for CCTV and transport data.
Colleges and universities hold admission, exam, scholarship, hostel and placement data, some of it about minors.
Coaching centres and tutoring businesses are fiduciaries for students and parents, often with heavy marketing activity.
EdTech and learning apps are fiduciaries for learner profiles, progress data and usage analytics.
School ERP, LMS, proctoring and transport vendors are usually Data Processors for the institution.
Personal data you are likely to hold
Key provisions for Education & EdTech
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Verifiable parental consent, no tracking or targeted advertising aimed at children, and no processing that harms a child's well-being.
Itemised notice, and consent that is specific and withdrawable.
Voluntarily provided data may be used for the stated purpose. Government institutions can also rely on State-function grounds.
Security, accuracy of records, erasure when no longer needed, processor contracts.
Rights to access, correct and erase, with a grievance process and nomination.
Research and statistical processing can be exempt when it meets the Rules' standards.
Failing to meet the children's-data duties can attract penalties up to ₹200 crore.
01Children, parents and verifiable consent
Most school students are children under the Act. Section 9 requires verifiable consent of a parent or lawful guardian before processing a child's personal data. Rule 10 explains how to verify that the person consenting is an adult and the child's parent, using reliable details you already hold, or a verified token from a government-backed service such as DigiLocker.
For a school, admission is a natural moment to collect that consent, record it and give the notice. For an edtech app, build it into sign-up and keep a record you can show later. Rule 11 adds verification rules for people with a disability who have a lawful guardian.
02What the education exemption covers and what it does not
Rule 12 and the Fourth Schedule exempt specified classes of fiduciary and purposes from some child-data duties. For educational institutions the exemption is limited to tracking and behavioural monitoring of children, to the extent needed for educational activities or the safety of students enrolled. It also covers a few related roles, such as child day-care and transport providers engaged by an institution.
- Covered: attendance and learning-progress tracking for teaching, and safety-related monitoring, within the Schedule's limits.
- Not covered: marketing to students, selling or sharing data with advertisers, profiling for commercial offers, and other uses beyond education and safety.
- Conditions apply. Read the Fourth Schedule on the Rule 12 page before relying on it, and record why an activity falls within it.
Purely commercial edtech platforms should not assume the exemption applies to them.
03Student records, results and retention
Admission records, mark sheets and transfer certificates are often kept for long periods because education laws, boards and universities require it. Under Section 8 you may keep what law or genuine institutional need requires, but must not keep everything forever. Set retention by record type:
- Permanent academic records: keep, with strict access control.
- Applications of unsuccessful candidates: erase after the cycle ends unless you need them for a stated reason.
- Counselling and health notes: keep to the minimum and restrict access to the people involved.
- Marketing leads: erase when the person withdraws consent or the campaign ends.
Be careful with public display. Publishing results, merit lists and photographs on notice boards and websites exposes personal data, so ask what the purpose requires and mask what it does not.
04CCTV, biometrics, proctoring and school apps
CCTV, biometric or face-based attendance, online proctoring and school-bus tracking all collect personal data and need a stated purpose, a notice and strong safeguards.
- Display notices where CCTV operates and say who can view footage and for how long it is kept.
- Choose the least intrusive method that does the job. Face recognition for attendance is hard to justify when a card works.
- Keep processing logs for at least a year (Rule 8) and protect them.
- Check proctoring and ed-tech tools for hidden data collection, advertising SDKs and overseas storage.
05EdTech, marketing and learning analytics
Learning analytics can be a legitimate educational use, but it must stay within the purpose the family was told about. What the Act bars is tracking, behavioural monitoring and targeted advertising directed at children where the exemption does not apply, and any processing detrimental to a child's well-being.
- Do not run behavioural advertising inside a children's learning app.
- Aim marketing about courses at parents, not children, and obtain parents' consent.
- Do not sell or share learner data with third parties for their own purposes.
- Explain progress dashboards and AI features in the notice, and let parents see what is held.
06Security, vendors and breaches
Student databases are attractive targets. Rule 6 sets the baseline: encryption or masking, access control, logging, backups and processor contract terms. Teachers, front-office staff and vendors should have only the access their jobs need.
Contract every ERP, LMS, transport, exam and cloud vendor under Section 8, because the institution remains responsible. On a breach, tell affected families and the Board as Rule 7 requires, with a detailed report to the Board within 72 hours.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Check what you must keep for academic or legal reasons, keep only that, and erase the rest, including data held by vendors.
Marketing needs consent, and for under-18s a parent's consent. Send only to those who agreed.
Document why it is necessary, whether a less intrusive method would work, and how long the data is kept. Check the Rule 12 conditions.
Targeted advertising aimed at children is barred. Remove it from child accounts.
Treat it as a breach: contain it, notify families and the Board, and review your vendor contract.
Compliance checklist
Common mistakes to avoid
Assuming the education exemption lets you market to students.
Collecting parents' consent informally, with no record.
Posting full mark lists and photographs publicly because it is "tradition".
Letting every staff member see every student's file.
Adopting a free app or tool without checking where it sends learner data.
Common questions
Do schools need parental consent for every use of student data?
Consent is the default for children, but Rule 12 exempts educational institutions from some child-data duties for tracking and behavioural monitoring needed for educational activities or student safety. Other uses, such as marketing, still need verifiable consent.
Who is a child under the DPDP Act?
Any person under 18. This includes most school students and some first-year college students.
Does a university have to follow the Act for adult students?
Yes. For adults, the general rules on notice, consent, legitimate uses, security and rights apply. Children's rules apply to any under-18 students.
Can we keep alumni data and contact alumni?
You can keep records the institution needs. Fundraising and promotional contact needs consent, and alumni can withdraw it at any time.
Are coaching centres and edtech companies covered by the education exemption?
Not automatically. The Fourth Schedule names educational institutions and specific purposes. Commercial platforms should check carefully and should not assume it applies.
What are the penalties?
Failing to meet the children's-data obligations can attract a penalty of up to ₹200 crore, and security failures up to ₹250 crore. The Board decides actual amounts after an inquiry.