DPDP Act for Edtech and Schools: A Compliance Guide

Who this is for: founders, product leaders and DPOs at edtech companies, schools, coaching institutes, test-prep platforms and education service providers.

Education is one of the sectors most affected by the DPDP Act, for one simple reason: most of its users are children. Under the Act, a child is anyone under 18. That brings almost every school student, and a large share of coaching and test-prep users, under Section 9, the Act's strictest set of obligations, carrying penalties of up to ₹200 crore.

At the same time, the Rules recognise that schools need to monitor attendance, progress and safety. This guide explains where that line falls, and what it means for schools and edtech platforms. For the general law, see The DPDP Act, Explained.

The three rules of Section 9

1. Verifiable parental consent. Before processing a child's personal data on the basis of consent, you must obtain verifiable consent from a parent or lawful guardian (Section 9(1)).
2. No detrimental processing. You must not process a child's data in any way likely to have a detrimental effect on the child's well-being (Section 9(2)).
3. No tracking, behavioural monitoring or targeted advertising directed at children (Section 9(3)). This prohibition applies even if a parent consents.

What "verifiable" means

Rule 10 requires fiduciaries to adopt appropriate technical and organisational measures to make sure the person giving consent is the child's parent, and an identifiable adult. It allows this through:

• reliable details of identity and age already available to the fiduciary, for example where the parent is an existing verified user
• identity and age details provided voluntarily by the parent, or a virtual token mapped to those details, such as one issued through DigiLocker

In practice, an edtech app needs a flow that identifies whether a user may be a child, routes consent to a parent, verifies that parent, and records the result. A checkbox saying "I am over 18" or "my parent has agreed" will not meet the standard. See what makes consent valid under DPDP for the wider consent rules.

The education exemption, and its limits

Rule 12 and Part A of the Fourth Schedule exempt certain classes of fiduciaries from Section 9(1) and 9(3) for specific processing. For education, the key entries are:

Part B of the Schedule also exempts certain purposes for any fiduciary, including creating a user account limited to email communication, tracking a child's real-time location for their safety, and confirming whether a user is a child.

Three limits matter:

• It is purpose-bound. A school tracking attendance and grades is covered. The same school using student data to market its summer programme, or sharing it with an advertiser, is not.
• It covers monitoring, not everything. The exemption lifts the parental consent and tracking rules for the listed purposes. Notice, security, retention and rights obligations still apply.
• It does not automatically cover edtech platforms. The exemption applies to fiduciaries that are educational institutions. A consumer learning app selling directly to families should assume Section 9 applies in full, unless counsel advises that it qualifies.

Schools, platforms and roles

When a school uses a learning management system, homework app or assessment tool, roles matter:

• If the school decides why and how student data is used and the vendor acts on its instructions, the school is the fiduciary and the vendor is a processor. The school needs a data processing agreement with each vendor.
• If the platform uses student data for its own purposes, such as product analytics, recommendations to families or marketing, it is a fiduciary for that processing, and Section 9 applies to it directly.

Platforms that serve schools and also market directly to families need to keep those two activities, and their data, clearly separated.

Marketing and advertising

Section 9(3) makes targeted advertising directed at children unlawful, whatever the parent agrees to. For edtech, that rules out:

• retargeting students with course ads based on their in-app behaviour
• advertising pixels and SDKs on student-facing pages and apps
• profiling students to target upsell campaigns at them

Marketing to parents, as adults, is still possible with their valid consent. Build your cookie consent and SDK setup so that advertising tags never fire for child users.

Product design: learning analytics and nudges

Adaptive learning, progress dashboards and personalised practice are core to edtech, and much of that processing can be justified for educational purposes. But design choices matter:

• Use behavioural data to support learning, not to maximise time-on-app or drive purchases.
• Avoid streaks, countdown timers and pressure tactics that could be "detrimental to the well-being" of a child under Section 9(2).
• Keep learning analytics separate from marketing systems.

Online proctoring

Remote exams can involve webcam video, screen recording, audio, keystrokes and behaviour analysis of children. That is intensive monitoring. It needs:

• a clear lawful basis, and verifiable parental consent where consent is the basis
• an itemised notice explaining exactly what is captured, why and for how long
• the minimum data needed, with short, fixed retention
• strong security and restricted access to recordings
• human review before any adverse decision about a student

Whether the Fourth Schedule exemption applies depends on whether the proctoring is run by or for an educational institution, for its educational activities.

Retention

Schools must keep certain academic records under education regulations, and Section 8(7) preserves retention required by law. Everything else, such as app usage logs, proctoring videos, marketing leads and inactive accounts, should be erased once its purpose ends. Large online platforms should also check the Third Schedule thresholds under Rule 8.

Edtech and schools checklist

Common mistakes

• Treating "I am 18" as verification. Self-declaration is not verifiable consent.
• Reading the school exemption as a blanket pass. It covers monitoring for education and safety only.
• Running ads to students. Section 9(3) prohibits targeted advertising directed at children, even with consent.
• Mixing B2B and B2C data. Student data received from schools cannot be repurposed for direct marketing.
• Engagement-driven design. Manipulative nudges may harm children's well-being under Section 9(2).

How ConsentifyAI helps

ConsentifyAI supports verifiable parental consent flows, with age identification, parent verification and per-purpose consent recorded in a tamper-evident audit trail. Its ROPA module distinguishes processing covered by the Fourth Schedule exemption from processing that needs consent, and its cookie management keeps advertising tags switched off for child users.