Who this page is for
EdTech platforms, K-12 schools, universities, coaching institutes, and corporate LMS providers handling learner profiles, minors' data, assessments, and placement records.
The personal data typically processed in this sector
These categories are typical for organisations in this sector. Your data record (Step 03) is where you map your exact data flows and systems.
Minor student profiles & parent/guardian contact details
- Where it comes from:
- Admissions forms, learning apps, and parent communication portals
- What the Act says:
- Section 9(1) and Rule 10 require verifiable parental consent before processing a child's personal data, subject to Fourth Schedule clinical/educational safety exemptions.
Learning telemetry, test scores & proctoring recordings
- Where it comes from:
- LMS platforms, video classrooms, and online assessment tools
- What the Act says:
- Section 9(3) strictly prohibits tracking, behavioural monitoring, or targeted advertising directed at children.
Fee payment records, scholarships & KYC documents
- Where it comes from:
- Fee portals, payment gateways, and ERP financial modules
- What the Act says:
- Limit collection to stated administrative and statutory purposes and retain audit logs for at least 1 year under Rule 8(3).
Alumni, placement & third-party EdTech SaaS processors
- Where it comes from:
- Placement cells, cloud LMS vendors, video conferencing, and CRM tools
- What the Act says:
- Sign Section 8(2) processor contracts and provide clear opt-out/withdrawal paths for post-course promotional outreach.
Which documents to start with
- Step 01: Start here. Confirm the Act applies and see which duties you already cover.
- Step 03: Know your data. List every item above, where it sits and which vendor or processor holds it.
- Step 05: Ask properly. The itemised notice shown with or before a consent request under Section 5(1) and Rule 3.
- Step 04: Set the rules. The governance policy behind your notices, retention, and vendor controls.
- Step 06: Keep only as long as needed. Erasure when the purpose ends unless another law requires retention, plus 1-year minimum log retention under Rule 8(3) and Seventh Schedule.
- Step 07: Answer people on time. Rights requests and grievance replies within the period you publish, up to 90 days under Rule 14(3).
- Step 09: Control your vendors. Your cloud, SaaS, payment, communication, and analytics processors.
- Step 09b: Sign the vendor contract. The mandatory Data Processing Agreement under Section 8(2).
- Step 11: When something goes wrong. Personal data breach notification to the Data Protection Board (within 72 hours under Rule 7) and each affected Data Principal.
Statutory timeline, SLA, and penalty ceiling
The DPDP Act, 2023 (9 Chapters, 44 Sections, 1 Schedule) and DPDP Rules, 2025 (G.S.R. 846(E), notified 13 Nov 2025: 23 Rules, 7 Schedules) enforce core Data Fiduciary obligations from 13 May 2027. Grievance redressal must complete within 90 days (Rule 14(3)), processing logs must be retained for at least 1 year (Rule 8(3) + Seventh Schedule), and failure to maintain reasonable security safeguards carries a statutory ceiling of up to ₹250 crore.
The documents are a drafting aid. Get legal advice for your situation.