DPDP for schools, colleges, coaching centres and edtech

Education runs on children’s data. Admission forms, attendance, marks, fee records, bus pick-up points, CCTV, counsellor notes, learning-app clickstreams and exam webcams all describe people under 18. The DPDP Act treats anyone who has not completed 18 years as a child, so in a school almost every learner is a child, and in a coaching centre or test-prep app most are.

That makes section 9 the centre of your programme: verifiable parental consent before processing a child’s data, nothing likely to harm the child’s well-being, and no tracking, behavioural monitoring or targeted advertising directed at children. Breaching these duties carries a penalty of up to ₹200 crore. The real risk sits in growth and sales: free-trial sign-ups by children, lead lists traded between edtech firms, retargeting ads, and topper photos on hoardings. This guide applies the Data Fiduciary playbook to education.

Are you a Data Fiduciary, a processor, or both?

• School, college or university: you are the Data Fiduciary for students, parents, applicants and alumni. Your ERP, LMS, video-class tool, transport GPS provider, CCTV vendor, payment gateway and SMS provider are your Data Processors. A trust running several schools is usually one fiduciary; decide who answers requests.
• Coaching or tuition centre: you are a fiduciary for students and parents. A franchisee may be your processor or a separate fiduciary; write it in the franchise agreement.
• Edtech app or online tuition platform: you are a fiduciary for learners and parents. Marketplace tutors are usually your processors, but become separate fiduciaries if they take students’ contacts for private tuition.
• Edtech or ERP vendor selling to schools: processing only on the school’s instructions makes you its processor. Using student data for your own analytics, marketing or AI training makes you a fiduciary for that use, needing verifiable parental consent for children. See the guide for SaaS and IT processors.
• Proctoring and exam-tech providers: usually the processor of the institution or exam body. Do not keep face images or recordings for your own model training.
• School transport operators: a fiduciary or processor depending on the contract, and the beneficiary of a narrow Fourth Schedule exemption for location tracking during travel.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Admission forms: name, date of birth, photo, address, parents’ details, previous school, transfer certificate	ERP, paper files, admissions CRM	Admission, enrolment	High (children)	During enrolment and as education rules require
Identity numbers: APAAR ID, UDISE+ student data, board registration numbers, masked Aadhaar where a scheme requires it	ERP, government portals	Statutory reporting, board exams, scholarships	High	As the relevant scheme or rule requires
Attendance, timetables, behaviour and discipline records	ERP, class registers	Education, safety	High	During enrolment, then a short period
Marks, assessments, report cards, certificates	ERP, LMS, board portals	Education, certification	High	Long; certificates and results registers are often permanent
Learning-app activity: clicks, time on task, quiz answers, video views	LMS, edtech backend, analytics	Learning features, progress reports	High (behavioural data of children)	Short; aggregate after the course
Live-class video, chat and recordings	Video-class vendor, cloud storage	Teaching, revision	High (faces and voices of children)	One term or course, then erase
Proctoring data: webcam, screen, face match, audio, room scans	Proctoring vendor	Exam integrity	High	Until results and appeals close
Health, disability and counselling records, allergies, special needs plans	School nurse, counsellor files, ERP	Care and safety, reasonable accommodation	Very high	As needed for care; restrict access
Fee, payment, scholarship and EMI records	Accounts, payment gateway, lending partner	Fees, finance	High	Tax and accounting laws set minimums
Transport: pick-up points, bus GPS, attendance on bus	Transport vendor app	Safety during travel	High (location of children)	Short, rolling
CCTV in campuses, buses and hostels	NVRs, security vendor	Safety	High	Short, rolling
Leads: free-trial sign-ups, counselling enquiries, scholarship test entries	CRM, telecalling tools, marketing agencies	Admissions and sales	High when the lead is a child	Short; consent-based
Alumni contacts	Alumni portal, CRM	Alumni relations, records	Medium	Consent-based
Staff and tutor records	HR, vendor portals	Employment	Medium	See the employers guide

Risk hotspots

1. Child sign-ups without parental consent. Free trials, scholarship tests and apps let a 14-year-old sign up with her own mobile number. Failure: every later message and call processes a child’s data without verifiable parental consent. Control: an age question at sign-up, a parent-verification step under rule 10 before any account or lead is created, and confirmation that a user is not a child where you allow adults only.
2. Targeted advertising and retargeting. Pixels and ad SDKs build audiences of children who visited a pricing page, and lookalike audiences are seeded with student lists. Failure: targeted advertising directed at children is banned outright by section 9(3), and no Fourth Schedule entry lifts that ban for ads. Control: no ad pixels or ad SDKs on pages and apps used by children, no audience uploads of student or parent lists that include children, and ads aimed only at adults on adult surfaces.
3. Learning analytics that turn into profiling. Dashboards that rank, label or predict “likely to drop out” or “high purchase intent” are behavioural monitoring. Failure: behavioural monitoring of children outside the narrow educational-institution exemption, or used for sales. Control: keep learning analytics to the educational purpose, never feed them into sales scoring, and document why each metric is needed.
4. Sales telecalling and lead lists. Lead lists are bought and sold, and children are called at home. Failure: processing children’s data with no consent, plus TRAI and consumer-law exposure. Control: no purchased lists, parent consent for every child lead, call scripts that ask for a parent, and a do-not-call register that sales cannot override.
5. Proctoring. Webcam, screen, audio and face-match data are collected at scale, often by a vendor abroad. Failure: excessive collection, indefinite retention, and biometric matching without a clear basis. Control: collect only what the exam needs, tell candidates exactly what is captured, erase after results and appeals close, and keep vendors under section 8(2) contracts.
6. Photos, results and topper publicity. Schools post photos on social media; coaching centres put toppers’ faces and ranks on hoardings and ads. Failure: using a child’s data for marketing without verifiable parental consent, and possible harm to well-being. Control: separate, revocable parental consent for publicity; take content down on withdrawal.
7. CCTV, transport GPS and hostel monitoring. Classroom cameras, live bus tracking and hostel entry logs are tracking. Failure: going beyond the exemptions, such as live CCTV feeds for all parents or months of GPS history. Control: safety only, restricted viewers, short retention, and no cameras in toilets, changing rooms or counselling rooms.
8. Health, disability and counselling records. The most sensitive records a school holds. Failure: teachers and vendors see diagnoses and counsellor notes. Control: separate access groups and a need-to-know list.
9. EMI and education loans. Edtech sales often bundle a loan for the parent. Failure: sharing family data with lenders unasked. Control: the lender collects consent in its own flow, after the parent asks for the loan.
10. WhatsApp groups and personal phones. Class groups expose every family’s number, and teachers keep photos on personal phones. Control: broadcast lists or an official app, and school-owned devices for photos.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Admission and enrolment of a child	Verifiable parental consent (section 9(1), rule 10), with the parent voluntarily giving the data	The parent fills the form; record that the parent is an identifiable adult.
Admission of an adult student (18 or over)	Consent, or 7(a) where the student voluntarily applies	No parental consent needed; do not ask parents for the adult student’s data by default.
Teaching, attendance, assessment and report cards	Verifiable parental consent for children; consent or 7(a) for adults	The Fourth Schedule lifts sections 9(1) and 9(3) for an educational institution only for tracking and behavioural monitoring for its educational activities or children’s safety.
Classroom CCTV, campus entry logs and attendance tracking for safety	Fourth Schedule, Part A (educational institution, safety)	Limited to the safety of enrolled children. Short retention.
School bus location tracking during travel	Fourth Schedule, Part A (transport engaged by the institution)	Only during travel to and from the institution.
Real-time location shared with parents for safety	Fourth Schedule, Part B (real-time location for safety)	Limited to tracking real-time location in the child’s interest. No location history for analytics.
A student email account used only for email	Fourth Schedule, Part B (email-only account)	Only the data needed to create the account. Other features in the suite need their own basis.
Confirming a user is not a child	Fourth Schedule, Part B	Limited to what the confirmation and rule 10 due diligence need.
Board exams, UDISE+ reporting, scholarships and statutory returns	7(d) or retention required by law, as the reporting rule provides	Share only what the rule requires. Part B item 2 (subsidies and benefits) is tied to processing by the State under 7(b); for a private school handling a State scholarship, rely on the scheme rules and get parental consent where in doubt.
Creating an APAAR ID	Parental consent for children, as the scheme provides	Treat it as voluntary unless a rule clearly says otherwise. Confirm the current requirement with counsel.
Fees, receipts and accounting	7(a) and retention required by law	Receipts to the parent who paid.
Online proctoring of adult candidates	Consent, or 7(a) where the candidate registers for the exam	Tell candidates exactly what is captured; offer a reasonable alternative where you can.
Marketing, newsletters, sales calls to parents and adult learners	Consent, per channel	Never targeted advertising directed at children.
Photos, results and testimonials in publicity	Consent (verifiable parental consent for children)	Separate from admission consent; revocable.

Notices and consent: getting the screens right

Channel	Do	Don’t
Admission office and paper forms	Give a short notice with the form, in the local language. Verify the parent and record consent with the notice version. Put publicity and marketing consents on separate lines.	Bury publicity consent in the admission form’s undertaking.
School app and parent portal	Use the parent’s verified account for consents. Let parents see and change choices for each child.	Let a child’s login change consent settings.
Edtech app sign-up	Ask age first. If under 18, move to parent verification before creating the account. If you serve adults only, confirm the user is not a child.	Create the account first and ask for the parent later.
Website and landing pages	Load no ad pixels on pages for children. Gate non-essential tags behind consent from adults.	Retarget visitors to class 8 to 12 course pages.
Telecalling and counselling	Speak only to a parent about a child. Read a short notice and record consent. Honour do-not-call at once.	Call children on numbers from scholarship tests or bought lists.
WhatsApp and SMS	Use official broadcast lists with opt-in records. Put STOP in every promotional message.	Add parents to large class groups that expose everyone’s number.
Live classes and proctoring	Tell learners what is recorded, who sees it, and for how long, before the camera turns on.	Record by default and keep recordings for ever.
Campus, hostel and transport	Put CCTV and GPS signage up and explain the safety purpose in the notice.	Share live camera feeds widely or use footage for discipline beyond safety.

Each notice must stand on its own, itemise data and purposes, and give a link or other means to withdraw, exercise rights and complain to the Board (rule 3). Parents must be able to read it in English or any of the 22 Eighth Schedule languages (section 5(3)). Start with the medium of instruction and the state language.

Verifiable parental consent in practice (rule 10)

Rule 10 asks you to check that the person giving consent as a parent is an identifiable adult. Its illustration sets out four cases, and your flows should cover each:

1. The child signs up and names a parent who already has an account with you. Let the parent identify herself, and confirm you already hold reliable identity and age details showing she is an adult.
2. The child signs up and names a parent who has no account. Check the parent’s identity and age against details issued by an entity entrusted by law or the government, or a virtual token mapped to them. The parent may use DigiLocker.
3. The parent opens the account for the child and already has an account with you. Confirm you hold reliable identity and age details for the parent.
4. The parent opens the account for the child and has no account. Check against government-issued details or a virtual token, for example through DigiLocker.

Never ask for an Aadhaar copy for this. Use DigiLocker or an equivalent token, or details you already hold. For a student with disability who has a lawful guardian, verify that the guardian was appointed by a court, a designated authority or a local level committee (rule 11).

What the Fourth Schedule exemptions cover, and what they do not

• Educational institution (Part A). Sections 9(1) and 9(3) do not apply where processing is restricted to tracking and behavioural monitoring for the institution’s educational activities, or in the interests of the safety of enrolled children. Attendance, classroom observation, learning progress and campus safety monitoring fit. Sales scoring, marketing, ad audiences and sharing with partners do not. Whether an edtech app or a test-prep platform is an “educational institution” (“an institution of learning that imparts education, including vocational education”) depends on what it does. Confirm with counsel before relying on it.
• School transport (Part A). A transport operator engaged by the institution may track children’s location during travel to and from it, for their safety. Not on weekends, not for route marketing.
• Email-only account (Part B). Creating an email account for a child is exempt to the extent needed, if the account is used only for email. A full productivity suite with chat, storage and analytics needs parental consent for those parts.
• Confirming a user is not a child (Part B). You may process data to check that a user is an adult and to carry out rule 10 due diligence.
• Targeted advertising stays banned. None of these exemptions allows targeted advertising directed at children. Section 9(2), no detrimental effect on well-being, applies throughout.

Other laws you must line up with

• Right of Children to Free and Compulsory Education Act, 2009: admission records, the economically weaker sections quota and records kept for that process.
• Board affiliation bye-laws (CBSE, CISCE, state boards) and UGC and AICTE regulations: records you must keep and report. Confirm the current requirement with counsel.
• UDISE+ and APAAR (Ministry of Education): student-level data goes to government systems. Share only what the scheme requires; APAAR creation needs parental consent as the scheme provides.
• Guidelines for Regulation of Coaching Centres, 2024 (Ministry of Education) and state coaching laws: registration, conduct and student welfare rules for coaching centres. Confirm the current requirement with counsel.
• Consumer Protection Act, 2019 and CCPA guidance on misleading advertising by coaching centres: claims about toppers and results, and dark patterns in sign-up and cancellation.
• POCSO Act, 2012 and child-protection guidelines: mandatory reporting and safeguarding duties, which can require you to keep and share records with authorities (7(d), 17(1)(c)).
• Rights of Persons with Disabilities Act, 2016: reasonable accommodation records, and the guardianship rules that rule 11 relies on.
• TRAI TCCCPR: consent and registration for promotional calls and SMS, which edtech telecalling often breaches.
• RBI Digital Lending Directions: apply to loans offered to parents through your platform; the lender carries its own duties.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents must be reported to CERT-In on a much shorter clock than the DPDP 72 hours. Confirm the current requirement with counsel.
• GST and income-tax law: fee and accounting records override erasure for those records only.
• Shops and Establishments Acts and labour codes: for staff and tutor records.

Retention and erasure

1. When the purpose ends (section 8(7)): a child leaves the school, a course ends, a trial is not converted, or an enquiry goes cold. Stop using the data. Keep only what education rules and accounting require (results registers, transfer certificates, fee records), and erase the rest after the one-year minimum.
2. The one-year minimum (rule 8(3)): keep personal data, traffic data and processing logs for at least one year from the processing, then erase them unless another law requires longer. Access logs for the ERP and LMS fall here too (rule 6(1)(e)).
3. Legal holds: certificates and results registers, records under board or university rules, POCSO and safeguarding records, records in a dispute or fee recovery, and data under a court order.
4. Short-lived data: live-class recordings, proctoring video, CCTV, bus GPS history and telecalling recordings should have short, fixed retention periods, set per purpose.
5. The Third Schedule: an edtech platform that sells courses online may be an e-commerce entity. If it has 2 crore or more registered users in India, it must erase a user’s data three years after they last engaged, with a warning at least 48 hours before (rule 8(2)). Data needed to access the account and virtual tokens, such as course credits or wallet balances, are excluded. Confirm with counsel whether you are an e-commerce entity.
6. Processors and backups: make your ERP, LMS, video, proctoring, transport and messaging vendors erase on instruction and confirm it. Document backup retention, and make sure restored backups replay erasures.

Rights requests and grievances

• Channels: the parent app or portal, a web form, the school office and an email address. Publish them with the identifier you need: admission number, enrolment ID, roll number or registered mobile (rule 14).
• Who can ask: for a child, the parent or lawful guardian exercises the rights. For an adult student, the student does. Do not answer a parent’s request about an adult student unless the student agrees or a law allows it.
• Identity: use an OTP to the registered mobile or the parent app login. Do not ask for an Aadhaar copy or documents you do not already hold.
• Access (section 11): give a summary of the data and processing, and list the other fiduciaries and processors you shared with: boards, government portals, ERP and LMS vendors, transport, proctoring, lenders.
• Correction (section 12): correct names, dates of birth and contact details through the procedure board and university rules lay down. Marks and evaluations are corrected only through your re-evaluation process.
• Erasure (section 12(3)): erase marketing data, recordings, analytics and publicity photos. Refuse erasure of results registers and records you must keep by law, and say which law.
• Grievances: publish a response period inside the 90-day ceiling (rule 14(3)); 15–30 days is good practice. Name your DPO or contact person in every reply (rule 9).
• Nomination (section 14): let adult students and parents nominate someone.

Turning 18, and alumni

The Act does not say what happens to parental consent when a student turns 18. The safer course is to treat the student as the Data Principal from that day: ask her to give her own consent for ongoing purposes, move rights requests to her, and stop sharing her data with parents unless she agrees. For alumni, keep the records the law requires and ask for fresh consent before using contacts for alumni networks, fundraising or marketing.

Breach readiness

Likely scenarios:

• an ERP or LMS misconfiguration exposing student records or marks
• a leaked lead database from an edtech sales team or agency
• a proctoring vendor breach exposing webcam recordings
• a live-class link shared publicly, with children on camera
• CCTV footage or photos of children leaked from a staff phone
• a ransomware attack on the school’s file server

Run-book:

1. Contain within hours: revoke links and vendor keys, disable compromised accounts, take exposed storage offline.
2. Assess: which data, how many children and parents, and which consequences, including grooming, bullying, extortion and physical safety.
3. Notify affected people without delay, through the parent’s account or registered contact for a child, covering every point in rule 7(1): what happened and when, the likely consequences, what you are doing, what they can do to protect themselves, and a contact.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)).
5. Report to CERT-In where its directions apply. Where children’s safety is at risk, follow your POCSO and child-protection procedures as well.
6. Learn: fix the root cause, re-train staff, and review vendor contracts.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Appoint a DPDP owner and a working group: principal or academic head, admissions, IT, legal, accounts, transport and marketing.
• [Academic] List every point where student data is collected: admissions, classrooms, exams, transport, hostel, health room, counselling, events.
• [Eng] Inventory every system: ERP, LMS, video-class tools, proctoring, apps, CRM, analytics, file shares, backups.
• [Marketing] List every pixel, ad SDK, audience upload and lead source, and mark which ones touch children.
• [Ops] Find the shadow systems: class WhatsApp groups, teachers’ personal phones, spreadsheets of leads and marks.
• [Legal] List all vendors (ERP, LMS, transport, CCTV, proctoring, payments, lenders, SMS, WhatsApp) and collect their contracts.
• [Product] Measure how many users and leads are under 18, including on free trials and scholarship tests.
• [Legal] Map what boards, universities, UDISE+, APAAR and scholarship schemes require you to keep and report.
• [Academic] Identify students with disability who have lawful guardians, and students turning 18 in the next year.
• [Leadership] Assess the likelihood of SDF status from the number of children whose data you process.

Phase 2: design and build (days 31–90)

• [Legal] Assign a basis to every purpose using the table above, and stop purposes without one.
• [Legal] Write down each Fourth Schedule exemption you rely on, with its limits.
• [Product] Build verifiable parental consent covering all four rule 10 cases, with DigiLocker for parents you cannot verify from your own records.
• [Product] Put an age question in front of every sign-up and trial; create no account or lead for a child before the parent is verified.
• [Marketing] Remove ad pixels and ad SDKs from every page and app used by children; stop audience uploads that include children.
• [Marketing] Stop buying lead lists; keep a do-not-call register that the sales team cannot override.
• [Academic] Separate publicity and photo consent from admission consent, and build a takedown process.
• [Legal] Write itemised notices for admission, the parent app, edtech sign-up, live classes, proctoring, transport and CCTV.
• [Ops] Translate notices into the medium of instruction and the state language; make all 22 available on request.
• [Product] Keep learning analytics to educational use; block their use in sales scoring or marketing.
• [Eng] Set retention for recordings, proctoring video, CCTV, GPS history and call recordings.
• [Eng] Encrypt student records at rest and keep ERP and LMS access logs for at least one year.
• [Security] Enforce MFA for ERP, LMS and admin consoles; review teacher and vendor access every term.
• [Academic] Move health, disability and counselling records into a restricted access group.
• [Ops] Limit CCTV to safety, name who may view footage, and keep cameras out of toilets, changing rooms and counselling rooms.
• [Ops] Configure the transport GPS app to track only during trips to and from the institution, with no long location history.
• [Product] For services meant only for adults, add a not-a-child confirmation step under Fourth Schedule Part B.
• [Legal] Add DPDP clauses to vendor contracts: security, breach notice, erasure, one-year logs, sub-processors, no own use of student data, audit.
• [Legal] Require EMI and loan partners to collect the parent’s consent in their own flow.
• [Ops] Replace large class WhatsApp groups with broadcast lists or the official app.
• [Product] Build the turning-18 flow: notify the student, ask for her own consent, move rights to her.
• [Product] Publish the privacy page: contact person, request channels, identifier needed, grievance period.
• [Ops] Set up the rights workflow, including rules for who may ask on behalf of a child or an adult student.
• [Eng] If you may be in the Third Schedule, build the three-year inactivity erasure with the 48-hour warning.
• [Security] Write the breach run-book, linked to your child-protection procedure.

Phase 3: operate (ongoing)

• [DPO] Review new apps, vendors, campaigns and features before launch for children’s data.
• [Marketing] Re-scan websites and apps every month for ad pixels on children’s pages.
• [Academic] Train teachers and staff every year on photos, WhatsApp, CCTV and confidentiality.
• [Ops] Audit telecalling every quarter for calls to children and ignored do-not-call requests.
• [Eng] Check every term that recordings, proctoring video and GPS history are erased on schedule.
• [Security] Run a penetration test every year and a breach tabletop drill against the 72-hour clock.
• [Ops] Review rights and grievance timelines every month.
• [Academic] Each month, start the turning-18 flow for students reaching 18.
• [Marketing] Check alumni lists for fresh consent before any alumni, fundraising or marketing campaign.
• [Legal] Review vendor contracts and renewals every quarter.
• [DPO] Keep evidence: parental consent records, verification results, withdrawals, erasure confirmations.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Verify the parent before processing a child’s data	An age gate and guardian verification through DigiLocker, covering parents you cannot verify from your own records.	Checking identity details you already hold (rule 10 cases 1 and 3).
Keep ads away from children	Tracking and ad purposes can never be marked child-safe, so they cannot be switched on for a child.	Removing pixels and SDKs from your pages.
Separate admission, publicity and marketing consents	Define each purpose once; the hosted consent page, widget or SDKs show each as a separate toggle, off by default.	Deciding which purposes need consent.
Let parents manage choices for several children	A family view in the person’s app.
Record paper admission forms	Record consent captured elsewhere, marked as not verified by the person.	Keeping the paper form.
Prove consent if a parent complains	Every choice is signed and hash-chained against the exact notice version, with a receipt and an evidence pack.
Stop calls and messages after a withdrawal	The verify API returns not permitted immediately; signed webhooks reach your CRM and dialler; overdue alerts flag misses.	Wiring it into your sales tools.
Guardians of students with disability	Lawful-guardian links with operator review.	Checking the appointment order.
Notices in Indian languages	English and all 22 Eighth Schedule languages, with machine-translation drafts flagged for review.	Reviewing the translations.
Make vendors stop and erase	A processor registry with contract dates and expiry flags; processors confirm withdrawals and erasures.	Signing the contracts.
Handle requests and grievances	A rights inbox with SLA timers and nomination; erasure closes with a structured proof.	The answers.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices (English and Hindi) and Board documents.	Detecting and investigating.

Not included: myconsentapp does not connect to your ERP or LMS out of the box (integration is through the API and webhooks), and it does not scan your site for ad tags.

Common mistakes

• Letting children sign up for trials and scholarship tests with their own mobile number.
• Stretching the educational-institution exemption to marketing, sales scoring or ad audiences.
• Running retargeting ads on class 9 to 12 course pages.
• Putting topper photos on hoardings on the strength of the admission form.
• Keeping proctoring video and live-class recordings indefinitely.
• Asking parents for an Aadhaar copy to “verify” them.
• Carrying on with parental consent after the student turns 18.
• Exposing every parent’s number in a 200-member class WhatsApp group.

Frequently asked questions

Do schools need parental consent for attendance and marks? The Fourth Schedule lifts sections 9(1) and 9(3) for an educational institution only for tracking and behavioural monitoring for its educational activities or children’s safety. Collect verifiable parental consent at admission for the wider processing (records, fees, communication); that is the safer approach.

Can we show ads to parents for our courses? Yes, with consent, on surfaces used by adults and aimed at adults. You cannot carry out targeted advertising directed at children, and no exemption lifts that ban.

Is an edtech app an “educational institution” under the Fourth Schedule? The Rules define it as an institution of learning that imparts education, including vocational education. Some edtech providers may fit; a content app or a marketplace may not. Confirm with counsel before relying on it, and never rely on it for marketing or ads.

Can our school bus app show parents the live location? Yes. Location tracking by transport engaged by the institution, during travel to and from it, for safety, is exempt. Real-time location for a child’s safety is also a Part B purpose. Do not keep long location histories or use them for other purposes.

How should we verify a parent without collecting Aadhaar? Use identity and age details you already hold for the parent, or a virtual token from an authorised entity such as DigiLocker, as rule 10 sets out. Do not keep copies of identity documents.

What about online proctoring for adult candidates? It needs a clear notice and consent, or 7(a) where the candidate registers for the exam. Collect only what the exam needs, erase after appeals close, and bind your vendor as a processor.

Do we need consent to upload data to UDISE+ or create APAAR IDs? UDISE+ reporting follows the government’s requirements, so share only what they ask for. APAAR creation is presented by the scheme as voluntary with parental consent. Confirm the current position with counsel.

Could a large edtech platform be a Significant Data Fiduciary? Possibly. The volume of children’s data and the risk to their rights are factors under section 10(1). These duties apply only once you are notified, but prepare for a DPO, an independent data auditor, and a DPIA and audit every 12 months (rule 13).