EdTech Student Data DPDP Compliance Checklist

Check your EdTech platform against Section 9

What age groups does your platform serve?

How do you obtain consent for under-18 users today?

Do you show ads or use behavioural tracking on the platform?

How long do you retain student data after a course or school year ends?

DPDP checklist for EdTech platforms handling student data

Verifiable parental consent captured before any processing of under-18 student data begins
No behavioural tracking, profiling or targeted advertising directed at children (S.9)
Privacy notice written in plain language, with a parent-facing summary as well as the full notice
Defined retention period for student records, attendance and assessment data — delete or anonymise after
Biometric attendance or proctoring data (if used) treated as sensitive and access-restricted
Data sharing with third-party edtech vendors (quiz tools, proctoring, analytics) covered by a processor contract

Why children's data is the highest-risk category under DPDP

The DPDP Act 2023 singles out children's data for the toughest treatment in the law. Section 9 requires verifiable parental consent before processing any personal data of a person under 18, and it flatly prohibits behavioural monitoring, tracking or targeted advertising directed at children — regardless of consent. For an EdTech company, this covers far more than login credentials: it includes attendance records, quiz and assessment scores, biometric attendance, video from live classes, and parent contact details captured at enrolment.

Penalties for failing children's-data obligations run up to Rs 200 crore per instance under the DPDP Act — among the highest penalty bands in the law, second only to security safeguard failures. For a school ERP or learning platform processing thousands of student records, an unverified consent flow or an ad-tech SDK collecting behavioural data is not a minor gap; it is the single biggest exposure on the platform.

What verifiable parental consent actually requires

A parent ticking a checkbox at signup does not meet the DPDP bar for verifiable consent. The DPDP Rules 2025 point toward identity-verification mechanisms — proof the person giving consent is genuinely the parent or lawful guardian, not just an email address. In practice this means EdTech platforms need a consent flow that can withstand a Data Protection Board inquiry: a record of who consented, when, to what specific processing purpose, and evidence the consenting adult was verified. Niti Bharat builds this consent architecture as part of a fixed-price EdTech DPDP Compliance Pack, alongside the privacy documentation and retention schedule schools and platforms need before the May 2027 enforcement deadline.

Get the EdTech Student Data DPDP Checklist (free PDF)

A one-page, print-ready checklist mapping every S.9 obligation to a specific control, so your team can self-audit before a school or investor asks for evidence.

Frequently Asked Questions

Does the DPDP Act apply to EdTech platforms used only by adults?+

The strict children's-data rules under Section 9 do not apply if your platform genuinely serves only 18+ learners. However, standard DPDP obligations — consent, privacy notice, breach response, Grievance Officer — still apply to any platform processing personal data of Indian users, adult or not.

What counts as targeted advertising to children under DPDP?+

Any advertising or content personalisation that uses a child's behaviour, activity history, or profile to select what is shown to them. Even non-ad personalisation based on tracking a child's activity can fall foul of Section 9 — the safest position for EdTech platforms serving under-18 users is no behavioural tracking at all.

Do school ERPs need separate consent from parents and teachers?+

Yes. Parents (or guardians) must give verifiable consent for their child's data. Teachers and staff are a separate category — their data is typically processed under employment-related legitimate use (S.7), not consent, but still needs a privacy notice and security safeguards.

Quick Answer