- Home
- Industries
- DPDP for edtech
Industry
DPDP for edtech
Most edtech users are children, and DPDP treats anyone under 18 as a child. That one fact shapes sign-up, analytics, ads and every growth experiment.
Short answer
Under DPDP anyone under 18 is a child, and processing a child's personal data needs verifiable consent of a parent (s.9(1), Rule 10). Edtech platforms must not undertake tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)), or processing likely to harm a child's well-being (s.9(2)). Rule 12 lifts s.9(1) and s.9(3) for educational institutions in Part A of the Fourth Schedule only within its conditions, and these duties begin on 13 May 2027.
Where personal data sits in edtech
- Student accounts: name, class, school, date of birth, and a parent's mobile number and email.
- Learning data: test scores, attempts, time spent per video, doubts asked, and progress reports sent to parents.
- Live classes: video recordings, chat and attendance.
- Proctoring: webcam images and screen activity captured during exams.
- Sales and counselling: leads from demo classes, counselling call recordings, and fee financing applications.
- School contracts: student rosters and teacher records uploaded by schools that use your platform.
- Ad and analytics SDKs: third-party code in your apps and pages that can collect device identifiers and behaviour.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Verifiable parental consent | s.9(1), Rule 10 | Before processing a child's data, check the parent is an identifiable adult using identity and age details you already hold, details the parent gives, or a virtual token mapped to such details. |
| No detrimental effect | s.9(2) | No processing likely to harm a child's well-being. Review features such as public leaderboards with full names against this test. |
| No tracking or targeted ads | s.9(3) | No tracking, behavioural monitoring or targeted advertising directed at children. Audit every ad and analytics SDK on child-facing screens. |
| Exemptions | Rule 12, Fourth Schedule | Part A includes educational institutions; Part B covers purposes such as age verification. Each applies only within its stated conditions. |
| Learners with a lawful guardian | s.9(1), Rule 11 | For a learner with a disability who has a lawful guardian, verify the guardian was appointed by a court, designated authority or local level committee before accepting consent. |
| Notice parents can read | s.5(3), Rule 3 | A notice understandable on its own, readable in English or any Eighth Schedule language. |
| Withdrawal | s.6(4) | A parent can withdraw consent as easily as it was given. |
Roles: fiduciary or processor
A B2C app that signs up students directly is the Data Fiduciary. When a school uses your platform for its own classes and decides why student data is used, the school is usually the fiduciary and you act as its processor under a contract (s.8(2)).
Many edtech companies do both. Keep school-instructed data separate from your own B2C use, and do not reuse a school's roster for your own marketing.
Rule 12 lists educational institutions in Part A of the Fourth Schedule, and the exemption from s.9(1) and s.9(3) holds only within the conditions stated there. Do not assume a B2C learning app counts as an educational institution. Read the conditions with counsel and record your reasoning; s.9(2) is not lifted.
A 90-day starting plan
- 01Days 1 to 30: find children and trackers
Identify every flow where a user may be under 18. Scan your web pages for trackers, list the SDKs in each app build, and mark which ones track or target ads.
- 02Days 31 to 60: build parental consent
Add an age question at sign-up and a parental consent step for under-18s using a Rule 10 method. Remove targeted ads and behavioural tracking from child-facing experiences.
- 03Days 61 to 90: separate school data and set retention
Put processor contracts in place with schools. Set retention for class recordings and proctoring images. Publish the Rule 9 contact and your grievance response period.
How TruePrivacy helps
- Parental consent requests consent from the guardian by email; the guardian verifies with a code, and the decision is recorded with a timeline and evidence. Consent can be revoked, and requests expire if the guardian does not decide in time. Decide with counsel which Rule 10 identity and age check you add.
- Cookie consent includes a website tracker scan that finds and categorises trackers, so you can decide which to remove from child-facing pages.
- Consent management records each purpose and every withdrawal, with SDKs for iOS, Android and React Native apps.
- The privacy center gives parents a branded portal to submit requests and check their status, and retention rules expire recordings on schedule.
What age counts as a child under DPDP?
Anyone who has not completed 18 years of age (s.2). That covers school students and many first-year college students.
Can edtech apps show targeted ads to children?
No. s.9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. Review every ad and analytics SDK on child-facing screens with that in mind.
Are schools exempt from parental consent?
Rule 12 lists educational institutions in Part A of the Fourth Schedule, exempt from s.9(1) and s.9(3) only within the conditions stated there. Read the conditions with counsel.
How do we verify a parent under Rule 10?
Check the parent is an identifiable adult using reliable identity and age details you already hold, details the parent provides, or a virtual token mapped to such details.
Keep reading
- Children's data under DPDP section 9 Section 9
- Rule 12 exemptions for children's data Rule 12
- Verifiable parental consent for DPDP Section 9
- Rule 11 guardian consent for persons with disability Rule 11
- Children's data and guardian consent under DPDP Section 9 · Rules 10–12
- DPDP for gaming and apps Industry
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin