Ed-Tech and K-12 Schools: A DPDP Act Impact Study

Executive summary

Overall impact: High.

Indian schooling now runs on software: school management systems, learning management systems (LMS), parent messaging and bus-tracking apps, and after hours, test-prep apps, coaching centres and webcam-invigilated mock tests. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), almost every one of these users is a child, because section 2(f) defines a child as anyone under 18.

The Act and the DPDP Rules, 2025 bring their main obligations into force on 13 May 2027. We rate the overall impact on the sector as High. Children's data carries its own penalty of up to ₹200 crore under the Schedule to the Act, and the sector's data is spread across vendors that schools rarely audit.

Three changes matter most.

• Parental consent becomes the front door. Any product that is not run by or for a school's teaching or safety needs verifiable parental consent for under-18 users. That includes most test-prep apps, coaching-centre apps and mock-test platforms.
• Growth tactics built on behavioural data stop for children. Section 9(3) bans tracking, behavioural monitoring and targeted advertising directed at children. Parental consent does not lift the ban. Many freemium funnels, upsell engines and proctoring products depend on exactly these activities.
• Schools answer for their vendors. A school is a data fiduciary (the organisation that decides why and how data is processed). It stays responsible for the software companies that hold its data, and it must decide how long CCTV footage, exam recordings and old student records are kept.

Most sector instruments deal with safety rather than data, which leaves the DPDP Act as the sector's main data law. Trayambic's article on children's data in schools and ed-tech analyses section 9 and its exemptions for schools in detail. This study looks at the industry as a whole.

Background

The sector has five main segments, and each uses personal data differently.

• School management systems and ERPs. Admission forms, birth certificates, parents' incomes, fees, attendance, report cards, health notes, transport routes and staff payroll. Sold as software-as-a-service; the vendor is usually a data processor, processing data on the school's behalf.
• LMS and classroom tools. Assignments, recorded lessons, quiz scores and activity logs. Some are licensed by the school; others are downloaded by families.
• Test-prep platforms. Phone-number sign-ups, mock-test results, doubt-solving chats, viewing patterns and counsellor call notes feeding a sales team, with fees sometimes financed by a lending partner.
• Coaching centres. Enquiry forms, biometric attendance, CCTV, WhatsApp batch groups and past results used in publicity.
• Assessment and proctoring vendors. Identity documents, facial images for face matching, webcam and microphone recordings, screen activity and automated "suspicious behaviour" flags, for schools, coaching companies, universities and employers.

The data principals (the people the data is about) are students, parents and staff. Under section 2(j), a child's parent is a data principal for the child's data, and parents are data principals in their own right for their own details. Test-prep and proctoring platforms serve students aged 15 to 22 side by side, so age has to be established, not assumed.

Data also flows outwards: from schools to government systems such as UDISE+ and the APAAR academic identity, and from platforms to payment gateways, messaging providers, cloud hosts, analytics and advertising software kits, and lenders.

Legal framework

The DPDP Act and Rules

These provisions matter most for the sector.

• Notice and consent (sections 5 and 6; Rule 3). Consent must be free, specific, informed, unconditional and unambiguous; the notice must itemise data and purposes and explain withdrawal and complaints to the Data Protection Board.
• Legitimate uses (section 7). This is a closed list with no general "legitimate interests" ground. For the sector, the relevant items are data voluntarily provided for a specified purpose (7(a)), processing by the State to provide a subsidy, benefit or service (7(b)), and complying with a legal obligation to disclose information to the State (7(d)).
• Children (section 9; Rules 10 and 12; Fourth Schedule). A fiduciary must obtain verifiable consent from a parent or lawful guardian, must not process data in a way likely to harm a child's well-being, and must not track, behaviourally monitor or target advertising at children. Educational institutions, crèches and child transport providers are exempt from the consent and monitoring rules, but only for educational activities or safety. No one is exempt from the advertising ban or the well-being duty.
• Fiduciary duties (section 8; Rules 6 and 7). The fiduciary answers for its processors and may use them only under a valid contract. It must keep data accurate where it drives decisions, maintain at least the Rule 6 security safeguards (including one year of logs), notify each affected person and the Board of a breach with a detailed report within 72 hours, and erase data once the purpose is served unless a law requires retention.
• Significant Data Fiduciaries (section 10; Rule 13). The government may designate a higher-risk fiduciary as a Significant Data Fiduciary (SDF), considering factors such as the volume and sensitivity of its data. An SDF needs an India-based data protection officer, an independent data auditor and annual impact assessments and audits.

Rule 4 on consent managers commences on 13 November 2026; sections 5 to 10 and the operational Rules on 13 May 2027.

Sector instruments

Three points stand out. PRAGYATA recommends no more than two synchronous sessions of 30 to 45 minutes a day for Classes 1 to 8, four for Classes 9 to 12, and 30 minutes of parent guidance for pre-primary. The caps are advisory, but a product built to maximise a child's screen time should be measured against them. And the NCPCR material is advisory: we found no binding NCPCR instrument on children's personal data as of October 2026.

How the laws fit together

Under section 38, the DPDP Act applies in addition to other laws and prevails in a conflict. Section 16(2) preserves stricter laws on transfers abroad; we found none in education.

The CBSE CCTV requirement shows how the two interact. Section 8(7) allows data to be retained where retention is "necessary for compliance with any law". Whether an affiliation bye-law of a board counts as "law" for this purpose is untested. A careful school should keep footage for the period the board requires, delete it on a fixed cycle after that, and keep a written record of the reasoning.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Consent at the front door: test-prep and coaching

A typical test-prep funnel runs from app download and phone-number sign-up to a free diagnostic test, a counsellor's call and a course offer. Every step changes if the student is under 18.

The first problem is age. A platform cannot seek parental consent until it knows it has a child, and many users are 17 or 18. Part B of the Fourth Schedule permits processing to verify that a user is not a child, so a minimal age check at sign-up is lawful. Rule 10 then requires the platform to confirm that the consenting parent is an identifiable adult, using reliable details it already holds or a virtual token from an authorised entity such as DigiLocker.

The second problem is the sales call. Calling a consenting parent about a course is lawful. Scoring the child's weak topics and screen time to decide which course to push is behavioural monitoring for targeted promotion, which section 9(3) prohibits outright. Learning analytics shown to the family must be kept apart from anything fed to sales.

The third problem is lead buying and fee financing. Bought leads rarely carry a consent trail naming the platform, and a financing lender is a separate fiduciary that the parent must be told about and deal with directly.

Coaching centres face the same issues offline. Enquiry forms collected at school gates, WhatsApp groups that expose every student's number and banners naming toppers all need a lawful basis and, for under-18s, parental consent.

Proctoring and assessment

Remote proctoring records a test-taker's face, voice, room and screen, and software flags glances, voices and tab switches. For children, the question is whose exemption, if any, applies.

• A school's own exams run through a proctoring vendor. The school is the fiduciary and the vendor is its processor. The Fourth Schedule exemption for educational institutions can cover the monitoring, because it is for educational activities. The exemption is the school's, so the vendor must act strictly on the school's instructions.
• Mock tests on a test-prep platform. The platform is the fiduciary and is not obviously an "institution of learning". Webcam monitoring of a 16-year-old is behavioural monitoring, and the platform should assume section 9(3) prohibits it. Practical alternatives include unproctored practice tests, or invigilation limited to identity checks with no recording or behavioural scoring.
• Entrance and recruitment tests for adults. Section 9 does not apply. The ordinary rules still do: a clear notice, a lawful basis, and security for facial images and recordings.

Two duties apply to every set-up. Section 8(3) requires accurate and complete data where it is used for a decision affecting the person, and a "cheating" flag that leads to disqualification is such a decision, so a human should review every flag and record the reasoning. Recordings should be deleted once the appeal window closes, not kept as training data. Facial images are not a special category under the Act, but Rule 6 still requires encryption or masking, access control and logging.

Schools as fiduciaries for their vendor stack

Most schools have no data team. Their compliance depends on five or six vendors: the management system, the LMS, the messaging provider, the bus-tracking app, the payment gateway and the CCTV contractor. Section 8(1) makes the school responsible for all of them "irrespective of any agreement to the contrary".

Three practical consequences follow.

• Vendors will be asked to do the compliance work. Vendors that build parent-consent screens, rights workflows, retention schedules and breach playbooks into their products will win renewals; those that cannot show Rule 6 safeguards will not.
• The vendor's own use of data must stop. Some ed-tech vendors licensed by schools have used student data to market their own consumer products. Under the Act that makes the vendor a fiduciary, without consent and probably in breach of section 9(3).
• Government flows need their own basis. The Supreme Court's order of 20 July 2026 requires APAAR processing to comply with the DPDP Act and bars sharing with private parties except as the law allows. Schools should keep APAAR consent records separate from enrolment.

The contract clauses themselves are covered in Trayambic's checklist on vendor contracts for SaaS companies, which applies equally to school software.

Edu-games and the Online Gaming Act

The Online Gaming Act defines an online social game as one without stakes, offered for entertainment, recreation or skill development, and section 4 directs the government to recognise, categorise and register such games. A maths game without cash prizes is likely to be a social game. A quiz league with paid entry and cash prizes is likely to be an online money game, banned by section 5 whatever its educational value. That Act regulates games, not data: leaderboards, streaks and in-game analytics remain DPDP questions, and for children they need a well-being check under section 9(2).

Worked example: a regional test-prep company

A test-prep company in Jaipur has an app with about 300,000 registered users, eight offline centres and a remote-proctored weekly mock test. About two-thirds of its users are in Classes 9 to 12. Under the DPDP Act it is a fiduciary, and it would rebuild its operations in six steps.

1. 1.Age gate. Sign-up asks only for date of birth; under-18s move to a parent-consent flow verified through DigiLocker or details held from a fee payment.
2. 2.Split analytics. Topic-level progress reports go to the student and parent. The sales dashboard sees only whether a parent has asked for a call.
3. 3.Change the mock tests. For under-18s, the weekly mock becomes unproctored with randomised questions. Proctoring with identity checks continues for adult aspirants, with every flag reviewed by a human.
4. 4.Clean up the centres. WhatsApp groups become broadcast lists; topper banners need separate parental consent.
5. 5.Set retention. Unconverted leads, adult mock recordings and centre CCTV footage are deleted on fixed, documented cycles.
6. 6.Fix the vendors. It signs processor terms, with breach notice in hours, with its video host, messaging provider and proctoring tool, and shares nothing with its financing partner until parents opt in.

The sales funnel is smaller but defensible, and the largest legal risk, a section 9 penalty of up to ₹200 crore, is designed out.

Compliance framework

Phased roadmap

• Now to December 2026: inventory products, ages and vendors; decide where the school exemption applies; freeze new targeting features for minors.
• January to March 2027: ship age checks and parental consent; renegotiate vendor contracts; remove advertising SDKs from under-18 journeys.
• April to May 2027: set retention and delete legacy data; test breach and rights processes; train counsellors, teachers and centre staff.
• Ongoing: audit vendors yearly; review new features for well-being risk; watch for SDF designations and any section 9(5) notification.

Recommendations

1. 1.Treat age as a design input. Find out early whether a user is under 18 and route children into a separate, lower-data journey.
2. 2.Decide, in writing, which products rely on the educational-institution exemption. Assume a direct-to-family product has none.
3. 3.Keep learning analytics away from sales and advertising. Section 9(3) is a prohibition, and parental consent does not cure it.
4. 4.Make proctoring proportionate: no behavioural monitoring of minors outside a school's own exams, and human review of every flag for adults.
5. 5.If you sell to schools, sell compliance too. Build consent, rights, retention and breach features into the product and contract as a processor.
6. 6.If you run a school, know your vendors. List them, sign processor terms and set deletion dates for CCTV, recordings and records of former students.
7. 7.Keep APAAR and other government flows separate, with their own consent records and no onward sharing.

Key takeaways

• Almost all users of school software, test-prep apps and coaching centres are children under the DPDP Act, so s.9 sets the terms for the whole sector.
• Schools can rely on the Fourth Schedule exemption only for educational activities and safety; test-prep and mock-test platforms should plan on verifiable parental consent and no behavioural monitoring.
• Remote proctoring of minors outside a school's own exams is high-risk; automated flags need human review under s.8(3).
• Schools remain responsible for their management-system, LMS, messaging and transport vendors, and must set retention for CCTV and recordings.
• Sector instruments (CBSE, PRAGYATA, NCPCR) deal mainly with safety; the DPDP Act is the sector's main data law from 13 May 2027.