DPDP Compliance for EdTech Companies: Student Data and Parental Consent

DPDP compliance for EdTech companies requires student data to be governed by age, purpose and the provider's role. For learners under 18, the DPDP framework generally requires verifiable parental consent before processing and restricts certain activities, including targeted advertising directed at children. Education-related exemptions have specific conditions that need to be assessed against the actual service.

For founders, product heads, privacy teams and technology leaders, implementation begins with the learner journey. A trial class, a school-managed account, a recorded lesson and an optional promotional campaign can involve different data, permissions and responsibilities.

When do DPDP obligations for EdTech begin?

As at 2 November 2026, the core DPDP processing obligations, including Section 9 on children's data, are scheduled to commence on 13 May 2027. The relevant Rules on parental consent and exemptions are part of that implementation phase. Existing consumer-protection and other applicable requirements continue to operate during the transition.

The Act defines a child as an individual below 18. It covers digital personal data and information collected offline that is subsequently digitized. An admission form uploaded to a platform and identifiable student activity in a learning system can therefore fall within scope.

Your DPDP readiness plan should distinguish school-age learners from adult students. Also separate the learner, parent, fee payer, school administrator and emergency contact. These people can have different rights and authority even when one phone number appears across their accounts.

Which student data should EdTech companies map?

Student data protection should cover onboarding information, learning activity, communications, recordings, assessments and associated household data. Map what the platform collects directly and what its embedded tools collect.

Your student data protection inventory should include names, dates of birth, school details, parent contacts, attendance, test answers, scores, learning histories, uploaded assignments, support chats, device identifiers and any audio or video. Public EdTech privacy disclosures show that learning platforms can also generate usage events, support recordings and service-provider data flows. These disclosures illustrate possible data categories; they do not establish the lawful design for another platform.

Your team should trace data through the learning management system, customer relationship management system, video provider, tutor tools, analytics services and advertising software development kits. A software development kit, or SDK, is code added to an app to provide another service and may create its own data flow.

For each purpose, your record should identify the learner age group, responsible entity, data needed, recipient, access level and retention rule. Keep the parent's own contact and payment information in scope as personal data relating to that adult.

How should DPDP compliance for EdTech handle parental consent?

Rule 10 requires appropriate measures to obtain verifiable parental consent before processing a child's personal data, subject to applicable exemptions. It requires due diligence to check that the individual identifying themselves as the parent is an identifiable adult.

The Rule permits reference to reliable identity and age details already held, or voluntarily provided identity and age details or qualifying virtual tokens. Its illustrations include verification through a Digital Locker service provider. The law does not prescribe Aadhaar collection as the universal method for every EdTech platform.

You should design the verification process around the minimum information needed. An OTP can establish access to a phone or email address; the broader workflow still needs to satisfy the required due diligence about the adult identifying themselves as the parent.

A practical parental-consent record links the child profile, parent identity reference, verification method, notice version, purpose, timestamp and affirmative action. Store raw identity documents only where the approved verification method and retention assessment justify doing so.

For example, a parent registering a child for live lessons should receive an understandable explanation of the information used for enrolment, teaching and the proposed recording arrangements. Optional marketing to the adult should have its own assessed permission. Payment authorisation and consent for the child's data address separate decisions.

Your account design should also explain withdrawal, changes to authorised contacts and how a learner's account will be reviewed when they turn 18. Keeping an account-age transition process is a practical governance measure, with the specific legal treatment assessed for the service.

Which education exemptions affect DPDP compliance for EdTech?

The education exemption is conditional. Rule 12 and the Fourth Schedule exempt specified classes and purposes from Section 9(1) and 9(3), subject to the listed conditions. The exemption does not remove all DPDP obligations.

For an educational institution, the listed condition restricts processing to tracking and behavioral monitoring for its educational activities or the safety of enrolled children. The Schedule defines educational institution as an institution of learning imparting education, including vocational education. Applicability requires examination of both the entity and processing purpose.

Your legal assessment should distinguish a school, a direct-to-consumer teaching provider, an outsourced learning platform and an advertising or analytics provider. Some EdTech businesses may fit the definition; the label EdTech alone cannot settle it.

A vendor working for a school also needs a role assessment. The school may determine a teaching purpose while the vendor processes under its instructions. If the vendor uses learner data for its own product development or commercial targeting, that activity requires separate analysis.

The exemption addresses specified parental-consent and tracking provisions. Section 9(2), which prohibits processing likely to cause a detrimental effect on a child's well-being, remains relevant. Review the assessment with Legal before enabling a feature or relying on an exemption.

What do the rules mean for learning analytics, proctoring and AI tutors?

You should evaluate each feature by what it observes, infers and does with student data. Calling a feature educational analytics does not establish that every form of monitoring is permitted.

Section 9(3) restricts tracking, behavioral monitoring and targeted advertising directed at children, subject to applicable exemptions. Parental consent alone cannot remove a statutory prohibition. Your review should establish whether a learning activity falls within a valid exemption and whether its design respects the child's well-being.

For remote proctoring, examine the need for camera and microphone access, recorded surroundings, any biometric processing, who can view the material and how long it remains available. Consider less intrusive ways to achieve the assessment purpose and document the decision.

An AI tutor can receive prompts, homework, inferred learning gaps and conversation history. Review what reaches the model provider, where it is processed, who can access it and whether it is reused for training. Providing personalised teaching and training a provider's general model are separate purposes to assess.

The DPDP research exemption is also conditional. Section 17(2)(b) concerns processing necessary for research, archiving or statistical purposes where the data is not used for decisions specific to a Data Principal and prescribed standards are followed. A system making personalized learner decisions needs a different assessment.

The OneConsent article on customer data and AI provides related guidance on distinguishing a service purpose from additional model-training uses.

How should platforms handle student testimonials and marketing?

Separate teaching records from promotional permissions. A class recording, student photograph or examination result collected during service delivery requires its own assessment before use in advertising.

The CCPA Guidelines for Prevention of Misleading Advertisement in Coaching Sector, 2024 require written consent before using a successful candidate's name, photograph, testimonial or video in an advertisement. That consent must be taken after selection. The requirement applies within the Guidelines' coaching-sector scope and already operates separately from the scheduled DPDP duties.

For a minor, evaluate the additional children's-data requirements as well. Your workflow should preserve the relevant approval, approved material, purpose and usage limits. An enrolment checkbox collected before results would not satisfy the CCPA's post-selection condition.

Review marketing SDKs and remarketing audiences independently from adult-parent communications. An adult paying for a course does not turn the child's activity history into unrestricted advertising data.

The Ministry of Education has also advised caution around EdTech subscriptions, payment authorizations and student safety. This reinforces the practical value of presenting fees, learning permissions and optional promotions as understandable decisions.

How long should EdTech companies retain student data?

You should set retention by record and purpose, with any applicable statutory preservation requirements. Course completion, trial expiry, refund resolution and a rights request can trigger different actions.

Section 8(7) requires erasure when consent is withdrawn or the purpose is no longer served, subject to retention necessary for compliance with law. Final Rule 8(3) also requires minimum one-year retention of personal data, associated traffic data and processing logs for specified Seventh Schedule purposes once effective.

Your retention design should separate restricted records required for compliance from recordings or datasets still used in teaching, analytics or marketing. Applying one long retention period to every class recording would need a purpose-specific justification.

For a parent or learner request, verify identity and authority, identify the correct profiles and route work to the relevant system owners. Consider other students' information before providing group-class recordings. Keep evidence of approved exceptions and completed vendor actions.

How can EdTech companies implement these controls?

Test DPDP compliance for EdTech through a child account, an adult learner account and a school-managed account. Each should demonstrate the appropriate notice, verification, purpose controls and rights route.

·       Map teaching, administration, support, analytics and promotional purposes.

·       Assess parental verification and any education exemption with Legal.

·       Review video, proctoring, AI and advertising tools against that assessment.

·       Set tutor and vendor access, security controls and retention rules.

·       Test withdrawal and rights requests across connected systems.

·       Preserve evidence of the decisions and downstream actions.

Your consent management platform evaluation should use these journeys, including failed verification and a withdrawn permission. DPDP compliance solutions should support the approved design without obscuring which decisions remain with the institution.

OneConsent lists notice management, consent and preferences, Data Principal Rights and processing-record modules. These can be evaluated for an EdTech privacy program. Any proposed parental-verification integration should be demonstrated against the platform's requirements.

The DPDPA readiness guide can help your team organise the wider implementation review.

Book a demo to discuss student consent and privacy workflows for the learner groups your platform serves.