Sector guide · Education
DPDP Act for schools, colleges and edtech
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Education is the sector where Section 9 does the most work. A child is anyone under eighteen, so most students are children, and processing their data needs verifiable parental consent under Rule 10, with a ban on tracking, behavioural monitoring and targeted advertising directed at them. The Fourth Schedule exempts educational institutions from parts of Section 9 for the education itself, not for anything beyond it.
Who is a child, and what that changes
Section 2(f) sets the age at eighteen. Section 9(1) requires verifiable consent of a parent or lawful guardian before processing a child’s personal data. Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 sets the verification standard: due diligence that the consenting adult is identifiable, using details already held or a Digital Locker token.
The carve-out, read carefully
Rule 12 and the Fourth Schedule switch off Sections 9(1) and 9(3) for educational institutions processing for the educational activities of the child, and for a few other listed classes and purposes. A learning platform that also profiles students for course recommendations, or shares data with an advertising partner, is outside the carve-out for that processing.
Edtech in particular
An edtech app is a Data Fiduciary for every learner and parent. Its analytics, its recommendation engine and its growth marketing all touch children’s data. The Schedule assigns the Rs 200 crore band to Section 9 failures. The consent flow has to reach the parent, verify them, and record the consent, and the product has to honour the Section 9(3) prohibition in its design, not only in its policy.
First five actions
- Age assurance at signup: know which users are under eighteen.
- A parental consent flow that meets Rule 10, with the evidence stored.
- Turn off behavioural tracking and ad targeting for child accounts by default.
- A Rule 3 notice written for parents, and a separate one for adult learners.
- Processor contracts under Section 8(2) with every tool that sees student data.
Questions people ask
- Can a school collect student data without parental consent?
- For the educational activities of the child, the Fourth Schedule exempts institutions from Section 9(1). For anything beyond that, such as marketing or sharing with third parties, verifiable parental consent is required.
- Does the Act allow learning analytics on students?
- Analytics for the education itself sits inside the carve-out. Behavioural monitoring for other purposes, and any targeted advertising, are prohibited by Section 9(3).
- We teach adults only. Does Section 9 matter?
- Only if a child ever signs up. Without age assurance you cannot know, and Section 9 applies whenever one does.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.