DPDP Act for schools, coaching and EdTech: student records, parents and exemptions

Schools, colleges, coaching institutes, test-prep apps and learning management platforms run on student and parent records. Admissions forms, attendance logs, fee receipts, exam scores, medical infirmary notes, school bus location apps and online proctoring videos are all digital personal data—or paper records that are later typed or scanned into a system. Because the Digital Personal Data Protection Act, 2023 defines a child as any individual below the age of eighteen years, almost every school and K-12 coaching or EdTech platform handles children's personal data.

What data a school, coaching centre or EdTech platform holds

Whether you run a neighbourhood school, a multi-city entrance coaching chain or a subscription learning app, the law applies to any digital personal data you collect in India or digitise from paper forms. Understanding which records sit in which system is the starting point for compliance.

Verifiable parental consent and the ban on tracking or targeting children

For any learner under eighteen years of age, the Data Principal is the child together with the parent or lawful guardian. Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent of the parent, and must verify that the person giving consent is an adult parent—either through reliable identity and age details already held by the fiduciary, or through identity and age details issued by the government or an authorised entity and made available through a Digital Locker service.

Alongside parental consent, the Act places two strict prohibitions on anyone handling children's data:

• You must not undertake any processing that is likely to cause any detrimental effect on the well-being of a child.
• You must not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.

How the Fourth Schedule exemptions work for educational institutions

The DPDP Rules, 2025 include a specific carve-out in the Fourth Schedule so that everyday schooling and child safety can function smoothly without violating the tracking ban or repeating parental consent for statutory duties. However, the exemption is tightly scoped:

• Part A (Educational institutions): An educational institution is exempt from the verifiable parental consent and no-tracking provisions only to the extent that the processing is restricted to two purposes—tracking and behavioural monitoring for the educational activities of the institution, and in the interest of the safety of children enrolled with the institution.
• Part B (Safety and transport tracking): Processing for tracking the real-time location of a child is exempt when restricted to ensuring the safety, security or protection of the child—covering school bus GPS tracking and campus check-in systems.

Crucially, the Fourth Schedule does not exempt a school, coaching institute or EdTech app when it uses student data for commercial marketing, sells lead lists to partner colleges, runs ad-tech retargeting pixels on student portals, or publishes a child's photograph and exam rank on billboards without separate parental consent.

ERP vendors, proctoring tools and WhatsApp groups

Most educational institutions rely on third-party Student Information Systems, fee payment gateways, cloud LMS providers and bus-tracking apps. Those software vendors are Data Processors. The school or EdTech company remains responsible for their compliance and must sign a valid contract requiring each vendor to encrypt student data, control staff access, maintain one-year access logs and report any data breach immediately.

Our view: seven practical actions for schools, coaching institutes and EdTech teams

In our view, education providers preparing for the 13 May 2027 enforcement date should put seven controls in place: