DPDP Act for schools: children’s data and parental consent
For schools, coaching institutes and the edtech companies that serve them: who counts as a child, how verifiable parental consent works under Rule 10, exactly what the Fourth Schedule exempts, and what stays off-limits.
Last updated 22 October 2026
How does the DPDP Act apply to schools?
Every student under eighteen is a child under the DPDP Act, so a school needs verifiable parental consent before processing a student’s personal data. The Fourth Schedule exempts only tracking and behavioural monitoring for educational activities or student safety. Schools also answer for the edtech vendors that process student data on their behalf.
Where the DPDP Compliance Suite is today
The Perimattic DPDP Compliance Suite is in development. It is not yet live or for sale, and the features on this page are planned, not shipped.
Sign upWhat does the DPDP Act require before a school processes student data?
Section 2(f) of the DPDP Act, 2023 defines a child as anyone who has not completed eighteen years, so almost every student is a child. Section 9 then sets three duties that go beyond the Act’s general rules:
- Section 9(1): obtain verifiable consent of the parent or lawful guardian before processing any personal data of a child.
- Section 9(2): do not undertake processing likely to cause any detrimental effect on the well-being of a child.
- Section 9(3): do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.
Breach of these additional obligations may attract a penalty extending to two hundred crore rupees (section 33 and the Schedule). Section 9(4) lets the Rules exempt certain classes of Data Fiduciaries and purposes from sub-sections (1) and (3), never from (2).
| Data you hold | DPDP duty | Section or rule | Applies from |
|---|---|---|---|
| Admission forms and parent details | Notice to parents; verifiable consent from an identifiable adult parent | Sections 5, 9(1); Rules 3, 10 | 13 May 2027 |
| Attendance, marks and classroom monitoring | Exempt from parental consent and the no-tracking bar if restricted to educational activities | Rule 12; Fourth Schedule Part A, item 3 | 13 May 2027 |
| CCTV and campus safety monitoring | Exempt as above if restricted to the safety of enrolled children | Rule 12; Fourth Schedule Part A, item 3 | 13 May 2027 |
| School bus GPS | Exempt for the transport operator if restricted to location during the journey | Rule 12; Fourth Schedule Part A, item 5 | 13 May 2027 |
| Photos on social media, alumni and fundraising lists | Verifiable parental consent; no targeted ads at children | Sections 9(1), 9(3); Rule 10 | 13 May 2027 |
| Student records held by edtech vendors | Valid contract; the school stays responsible for the vendor | Sections 8(1), 8(2); Rule 6(1)(f) | 13 May 2027 |
Sections 3 to 17 of the Act, which hold section 9 and the other duties above, come into force on 13 May 2027 under the commencement order of 13 November 2025 (G.S.R. 843(E)), the same day as Rules 3 and 5 to 16 (Rule 1).
How does verifiable parental consent work under Rule 10?
Rule 10 of the DPDP Rules, 2025 requires appropriate technical and organisational measures to ensure verifiable consent of the parent is obtained before processing any child’s data, and due diligence to check that the person identifying as the parent is an identifiable adult. The check can rely on:
- reliable identity and age details the school already holds, for example from an earlier registration; or
- identity and age details the parent voluntarily provides, directly or through a virtual token issued by an authorised entity, which includes details made available and verified by a Digital Locker service provider.
The Rule’s illustrations cover both a child declaring a parent and a parent opening the account. In each, the Fiduciary checks that it holds, or is shown, reliable identity and age details for the parent before processing the child’s data. For a student with a disability who has a lawful guardian, Rule 11 requires verifying that the guardian was appointed by a court, a designated authority or a local level committee under the applicable law.
Which school processing does the Fourth Schedule exempt?
Rule 12 and the Fourth Schedule lift sections 9(1) and 9(3), but only for listed classes and purposes and only within stated conditions. Those relevant to schools:
| Who or what | Exempt processing (the condition) | Part and item |
|---|---|---|
| Educational institution | Tracking and behavioural monitoring for its educational activities, or in the interests of the safety of enrolled children | Part A, item 3 |
| Crèche or child day care centre | Tracking and behavioural monitoring in the interests of the safety of children in its care | Part A, item 4 |
| Transport provider engaged by the school | Tracking children’s location for their safety during travel to and from the school | Part A, item 5 |
| Creating an email account | Only to the extent necessary to create an account used only for email | Part B, item 3 |
| Real-time location of a child | Only tracking real-time location in the interest of her safety, protection or security | Part B, item 4 |
| Blocking harmful content | Only to keep information, services or ads likely to harm the child from reaching her | Part B, item 5 |
| Age checks | Only to confirm a user is not a child and to carry out Rule 10 due diligence | Part B, item 6 |
The Rules define an educational institution as an institution of learning that imparts education, including vocational education. They do not say whether an online-only platform qualifies, so an edtech company should not assume the school exemption covers it. Even where an exemption applies, the rest of the Act still does: a notice, security safeguards, breach intimation under Rule 7, and the bar on processing that harms a child’s well-being.
What should schools check in edtech vendors?
A learning management system, fee app, attendance tool or online exam platform that processes student data for the school is the school’s Data Processor. Section 8(1) keeps the school responsible for that processing irrespective of any contract, and section 8(2) requires a valid contract. Before signing, check that the vendor:
- processes student data only for the school’s purposes, never for its own advertising or product profiling (section 9(3));
- applies Rule 6 safeguards: encryption or masking, access control, access logs kept for a year, and backups;
- tells the school promptly of any breach so the school can meet Rule 7;
- erases the data when the school asks or the contract ends, unless a law requires retention (section 8(7)(b)); and
- discloses its own sub-processors, because parents can ask for the identities of everyone their child’s data was shared with (section 11(1)(b)).
An edtech app that parents sign up to directly is a Data Fiduciary in its own right. It needs its own verifiable parental consent under Rule 10, and section 9(3) bars it from targeted advertising directed at children.
How will the Perimattic DPDP Compliance Suite help schools?
For schools, coaching institutes and the edtech companies that serve them, the planned features most relevant are:
- A children’s data workflow for verifiable parental consent under Rule 10.
- A personal-data inventory that marks which processing falls within a Fourth Schedule exemption.
- A notice builder for parent notices in English and Eighth Schedule languages.
- A rights-request tracker for requests made by parents on a child’s behalf.
- A processor and vendor register for edtech tools, with contract tracking.
- A breach response workflow for parent intimations and Board reports under Rule 7.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Using it will not by itself guarantee compliance. Sign up to tell us how your school handles student data.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP compliance
The DPDP Act for schools, answered
Who counts as a child under the DPDP Act?
Section 2(f) defines a child as an individual who has not completed the age of eighteen years. That covers every school student in practice, including those in Classes 11 and 12. Under section 2(j), the Data Principal for a child includes her parents or lawful guardian, so they exercise her rights and give consent on her behalf.
Are schools exempt from parental consent under the DPDP Rules?
Only partly. Part A of the Fourth Schedule removes the parental consent and no-tracking requirements for an educational institution where processing is restricted to tracking and behavioural monitoring for its educational activities or in the interests of the safety of enrolled children. Other processing, such as publishing photos or sharing data with an app for its own use, still needs verifiable parental consent.
Can a school bus operator track students’ location?
Yes, within limits. The Fourth Schedule exempts a Data Fiduciary engaged by an educational institution, crèche or child care centre to transport its children, where processing is restricted to tracking their location, in the interests of their safety, during travel to and from the institution. Location data outside those journeys, or used for anything else, falls outside the exemption.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up