DPDP for schools, colleges and coaching

Verifiable parental consent, and what may not be done at all

Before processing a child’s personal data you need verifiable consent from a parent or lawful guardian (s. 9(1)). The Rules describe how to check that the person consenting is an adult who is the parent, for example using details you already hold reliably or an identity token from an authorised source such as DigiLocker.

Separately, you must not track children, monitor their behaviour, or direct targeted advertising at them (s. 9(3)), and must not process their data in a way likely to harm their well-being. This applies to every app and platform you put in front of students, whoever built it.

The Rules exempt educational institutions from some of these requirements for specific purposes: tracking and behavioural monitoring for educational activities and in the interests of children’s safety. The exemption covers those purposes only. A learning app that profiles students to sell them courses is outside it. Under legal review: The scope of the Fourth Schedule exemption for educational institutions, and whether it extends to an EdTech provider acting for the school, should be confirmed.

Students turn 18 during college. From then on the student, not the parent, is the Data Principal who consents and makes requests.

Needs parental consent

Admission records, photographs used publicly, learning-app accounts not covered by an exemption.

Never for children

Targeted advertising, and tracking or behavioural monitoring outside the exempt purposes.

At 18

The student takes over consent and requests from the parent.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

Ananya, aged 11, studies at a private school. The school keeps records in a school ERP, sets homework on a learning platform, uses a third-party EdTech app for maths practice, takes biometric attendance, and runs buses through a transport contractor.

If the maths app uses Ananya’s activity to recommend paid courses or show adverts, it is deciding its own purpose and becomes a fiduciary, and targeted advertising at a child is prohibited outright. Under legal review: Whether course recommendations amount to targeted advertising under s. 9(3) depends on the facts.

What a school or college holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Admission and enquiry forms
• School ERP and parent portal
• LMS and EdTech apps
• Biometric attendance devices
• Examinations, online tests and proctoring
• Transport, CCTV and visitor registers

Where it goes

Where schools and colleges are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

46 controls written for schools and colleges, on top of 66 common ones

Alongside the common controls, the education assessment asks about children and the systems around them: verifiable parental consent and the institution exemption, EdTech approval and tracking settings, marks and attendance, examinations and proctoring, biometric attendance, CCTV and bus location, teachers’ phones and parent groups, faculty records, and how long student and applicant records are kept.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. EDU-01 Critical

   At admission, do you take verifiable consent from a parent or guardian before recording a child's details, beyond what any exemption for educational institutions covers?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Verifiable consent recorded at admission.

   Why it is asked: A child's data needs verifiable consent from a parent. The exemption for educational institutions covers only tracking and behavioural monitoring for educational activities or safety, not admission records in general.

2. EDU-02 Critical

   Have you checked that the learning apps and platforms your students use do not track them, profile their behaviour or show them targeted advertising?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Checked for every app.

   Why it is asked: Tracking, behavioural monitoring and targeted advertising directed at children are prohibited. An institution's own monitoring for educational activities or safety is exempt; targeted advertising never is.

3. EDU-38 Medium

   Must an app or website be approved before teachers sign students up to it, with its data use checked first?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Approval is required and recorded.

   Why it is asked: A free app chosen by one teacher can collect a whole class's data with no contract and no check.

4. EDU-47 High

   Is biometric data used only for attendance or access, stored as protected templates rather than images, with an alternative available, and deleted when people leave?

   Answers: Yes, Partly, No, Not sure · “Yes” means: All four are in place.

   Why it is asked: A fingerprint cannot be changed once leaked. Consent to biometrics must be free, which needs an alternative; for staff, where employment is the basis, an alternative remains good practice.

5. EDU-03 High

   Do you avoid publishing marks, ranks or attendance with students' names beyond the people who need to see them?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Results go only to each student and family.

   Why it is asked: Publishing marks with names discloses data beyond its purpose. Toppers' results in advertising need consent.

6. EDU-49 High

   Before a proctored exam, are students told what is recorded and who reviews it, and are recordings deleted once results and appeals are final?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Told in advance; deleted on schedule.

   Why it is asked: Proctoring captures video of students' homes. A notice and a short retention period keep it proportionate.

All 46 questions written for schools and colleges

1. EDU-08 For your school ERP, learning platform and EdTech tools, have you agreed in writing who decides how student data is used, and whether the provider may use it for anything of its own? Organisation and role mapping
2. EDU-09 Have you identified every group whose data you hold: students, parents and guardians, applicants, alumni, teachers and visiting faculty, drivers and attendants, and visitors? Organisation and role mapping
3. EDU-10 Does your admission form leave out details you do not need, such as parents' income, occupation, religion or caste, unless a fee concession, reservation or legal return requires them? Data inventory and purpose
4. EDU-11 Do you know where old student data sits: paper admission registers, retired ERP systems, old exam records and personal drives used by teachers? Data inventory and purpose
5. EDU-13 At admission, are parents (and adult students) told what data you collect and why, including the ERP, learning apps, transport tracking and photographs you will use? Notice and transparency
6. EDU-15 Are photographs and videos of students used on your website, social media, prospectus or hoardings only with a separate consent (from a parent where the student is a child), which can be withdrawn? Consent and lawful basis
7. EDU-16 Is teachers' and staff data used only for employment, with profiles, photographs or results used in advertising only with each person's consent? Consent and lawful basis
8. EDU-17 Are prospective students and parents contacted only when they enquired themselves or agreed, and never from bought or exchanged lead lists? Consent and lawful basis
9. EDU-18 Do you know who may make requests about a student: the parent or guardian for a child, the student once 18, and what you do when separated parents disagree? Data Principal rights
10. EDU-19 Can students and parents have personal details corrected, with changes to marks or certificates made through an approved process that keeps the original visible? Data Principal rights
11. EDU-01 At admission, do you take verifiable consent from a parent or guardian before recording a child's details, beyond what any exemption for educational institutions covers? Children and guardians
12. EDU-02 Have you checked that the learning apps and platforms your students use do not track them, profile their behaviour or show them targeted advertising? Children and guardians
13. EDU-20 Where you rely on the exemption for educational institutions, is tracking and behavioural monitoring of children limited to educational activities and their safety? Children and guardians
14. EDU-21 Do you avoid uses of children's data likely to harm them, such as displaying disciplinary records, counselling notes, health conditions or "weak student" labels where other students and parents can see them? Children and guardians
15. EDU-22 Before marks, attendance or assessment data are used to decide promotion, detention, eligibility or scholarships, are they checked, with a route for the student to challenge errors? Data quality
16. EDU-23 Is data you upload to boards, universities, scholarship portals and national academic systems checked first, with corrections passed on? Data quality
17. EDU-07 Do you have a rule for how long records of former students are kept, and delete them when that period ends? Retention and deletion
18. EDU-24 Is the data of applicants who did not join deleted once the admissions cycle and any appeal period end? Retention and deletion
19. EDU-25 Are answer scripts, entrance test papers and evaluation records destroyed when the period your board or university sets ends? Retention and deletion
20. EDU-26 Are lab computers, tablets, teachers' laptops and attendance devices wiped before disposal, return or repair? Retention and deletion
21. EDU-06 Do teachers avoid keeping student data on personal phones and in personal WhatsApp groups? Security safeguards
22. EDU-27 Are student records in the ERP, its backups and exported spreadsheets encrypted, with Aadhaar and other identity numbers masked? Security safeguards
23. EDU-28 Are students' health, counselling, disability and special needs records kept separately, open only to the staff who support those students? Security safeguards
24. EDU-36 When results, fee details or messages about a child are sent to the wrong parent or posted to the wrong group, is it logged as an incident and notified to the Board and the families affected? Breach response
25. EDU-05 Are transport operators, fee-collection services and other vendors who receive student data bound by written data terms? Processors and vendors
26. EDU-37 Do your ERP, LMS and EdTech contracts require immediate breach notice, forbid the provider using student data for its own purposes, and require return and deletion when you leave? Processors and vendors
27. EDU-38 Must an app or website be approved before teachers sign students up to it, with its data use checked first? Processors and vendors
28. EDU-03 Do you avoid publishing marks, ranks or attendance with students' names beyond the people who need to see them? Data sharing and disclosure
29. EDU-39 Is student or parent data shared with partners for their own use (coaching tie-ups, banks, insurers, photographers, sponsors) only with consent and stated in your notice? Data sharing and disclosure
30. EDU-40 Do you log each release of student records: transfer certificates, records sent to other schools or universities, and data given to scholarship bodies? Data sharing and disclosure
31. EDU-41 Are requests for student data from police, child welfare bodies and courts checked by a named person, limited to what is required, and logged? Data sharing and disclosure
32. EDU-42 Do you communicate with parents through a channel that does not show every parent's number to the whole class, and avoid discussing individual children in group messages? Data sharing and disclosure
33. EDU-43 Do you know where your ERP, learning platform, email and cloud storage keep student data, including backups? Transfer and storage location
34. EDU-44 Where student data goes abroad (foreign university partners, exchange programmes, overseas platforms), have the transfers been checked against any government restriction? Transfer and storage location
35. EDU-45 Do you keep parental consents, publicity consents and release records so you can show, for any student, what was agreed and what was shared? Records and evidence
36. EDU-30 In your ERP, can class teachers see only their classes, and are fee, health and disciplinary records limited to the staff who handle them? Access control
37. EDU-31 Are accounts of teachers, visiting faculty and interns removed when they leave, and student accounts closed or converted after they graduate? Access control
38. EDU-32 Is two-step sign-in required for ERP administrators, the principal, the accounts team and institutional email? Access control
39. EDU-33 Does your parent or student portal show each family only its own children, with identity checked before a login or password is reset? Access control
40. EDU-34 On shared lab computers and campus Wi-Fi, are students kept out of staff systems, with staff logins never saved on shared devices? Access control
41. EDU-35 Do you review who has access to student records at the start of each term, and remove access that is no longer needed? Incident testing
42. EDU-46 Is there a written policy for teachers covering photographing students, parent groups, personal phones and signing students up to apps? Policy and training
43. EDU-04 Is CCTV on campus signposted, with access to footage limited and a set period after which it is deleted? Notice and transparency
44. EDU-49 Before a proctored exam, are students told what is recorded and who reviews it, and are recordings deleted once results and appeals are final? Notice and transparency
45. EDU-47 Is biometric data used only for attendance or access, stored as protected templates rather than images, with an alternative available, and deleted when people leave? Security safeguards
46. EDU-48 Is live bus location shown only to parents of children on that route, with location history and bus camera footage kept for a set short period? Security safeguards

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• Admission form with the notice and parental consent section
• Method used to verify that the consenting adult is the parent
• List of every app and platform used with students, with the check of tracking and advertising settings
• ERP, LMS and EdTech contracts, with clauses on breach notice and no reuse of student data
• Biometric attendance settings showing templates, not images, and the alternative offered
• Policy on photographs, personal phones and parent groups, with staff acknowledgement
• CCTV signage, named viewers and the overwrite period
• Retention schedule for student, applicant, examination and faculty records

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. List every app used with students and switch off tracking and advertising

   Now

2. Stop publishing marks and ranks with names outside the class and parents

   Now

3. Add verifiable parental consent to admission

   Before 13 May 2027

4. Require approval before any new EdTech tool is used with students

   Before 13 May 2027

5. Move class communication to a school-controlled channel

   Before 13 May 2027

6. Sign data terms with ERP, LMS, biometric, transport and fee vendors

   Before 13 May 2027

7. Brief teachers each year on children’s data

   Ongoing, yearly

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports a school or college usually needs

In education the result goes to the management committee or trust, and it helps answer parents who ask what happens to their children’s data.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.