A 17-year-old signs up for a revision app. Before they answer their first question, the app has created an account, sent a device identifier to an analytics provider and added the parent's number to a sales list.
Each action needs its own explanation. Permission to provide lessons does not settle whether the platform may track the student's behaviour, share identifiers with advertising partners or market a different course to the parent.
Under India's DPDP Act, a child is anyone under 18. Section 9 establishes verifiable parental consent, restrictions on tracking and behavioural monitoring, a prohibition on targeted advertising directed at children, and a separate restriction on processing likely to harm their well-being. The final Rules include conditional educational exemptions. They do not give every education product a blanket exemption.
Updated 3 October 2026. Section 9 and the relevant Rules are scheduled to commence in May 2027 under the commencement notification and Rule 1. The flows below are preparation for that framework.
The three questions to answer before redesigning signup
Start with the activity, the decision-maker and the legal route. Those three answers determine what your product needs to do.
| Question | What the answer changes |
|---|---|
| Is the learner under 18? | Whether the children's-data provisions apply; a Class 12 learner may still be a child even if they choose and pay for the course themselves |
| Who decides the purpose and means of this processing? | Whether the school, platform or both are acting as Data Fiduciaries, and whether a vendor acts only as a processor |
| Does a specific exemption cover this activity? | Whether the relevant Section 9(1) and 9(3) obligations are disapplied, subject to the exemption's conditions |
A school-facing learning management system might process attendance on a school's instructions while independently deciding to use student records for its own product research. Those activities need separate assessments. A student login does not, by itself, make the vendor an independent fiduciary; the decisions about purpose and means do.
For the underlying role test, see who qualifies as a Data Fiduciary. Record the answer in the school contract and make sure the product behaves accordingly.
What Section 9 requires
Section 9 of the Act addresses three different issues. Treat them as separate checks in a product review.
Parental consent. Section 9(1) requires verifiable consent from the parent before processing a child's personal data, subject to applicable exemptions. The provision includes a lawful guardian where applicable.
The child's well-being. Section 9(2) prohibits processing likely to cause a detrimental effect on the child's well-being. A signed consent record does not resolve that assessment.
Tracking and advertising. Section 9(3) prohibits tracking or behavioural monitoring of children and targeted advertising directed at children, subject to applicable exemptions. Parental consent alone does not override this prohibition.
That last distinction matters for learning products. A parent may consent to an account, but that does not automatically authorise every analytics event, recommendation engine or advertising integration attached to it.
The educational exemption: who and what does it cover?
Rule 12 and Part A of the Fourth Schedule of the final DPDP Rules 2025 provide a conditional exemption from Sections 9(1) and 9(3) for a Data Fiduciary that is an educational institution.
For that entry, processing is restricted to tracking and behavioural monitoring for the institution's educational activities or in the interests of the safety of children enrolled with it. The Schedule defines an educational institution to include an institution of learning imparting education, including vocational education.
The assessment therefore needs both parts: does this entity qualify, and does this particular activity stay within the stated conditions? A commercial provider should examine its actual function and processing. The words “EdTech company” neither establish nor rule out eligibility on their own.
Consider three illustrative situations:
- A school monitors progress in its own lessons. This is the kind of activity to assess against the educational-institution entry, with the purpose and boundaries documented.
- A vendor operates the school's system on instructions. Establish the school's legal route and the vendor's processing limits. The arrangement does not automatically authorise the vendor's independent reuse.
- A learning app sends student activity to an advertising audience. An educational purpose for the app does not establish that this separate advertising use falls within the exemption.
Rule 12 does not exempt Section 9(2)'s well-being restriction. Other obligations, including security and applicable retention duties, also need their own treatment.
Keep a short exemption record: the fiduciary, the exact Schedule entry, the activity, the conditions, the data involved and the reviewer. Revisit it when the purpose or vendor arrangement changes. That is a recommended evidence practice, not a prescribed statutory form.
A parental-consent flow that answers the right questions
Where verifiable parental consent is required, a checkbox saying “My parent agrees” does not establish that an identifiable adult gave it. Equally, collecting a full identity-document image from every family should not become an automatic design choice.
Rule 10 requires due diligence to check that the person identifying themselves as the parent is an adult who can be identified if required. It allows reference to reliable identity and age details already available to the fiduciary, or voluntarily provided details, including a qualifying virtual token from an authorised entity. The Rule's illustrations include verified details or tokens made available through a Digital Locker service provider.
An OTP proves control of a contact channel. By itself, it does not prove that the person is an adult or resolve the parental-consent requirement. It can form part of a flow backed by suitable identity and age evidence.
A workable design might look like this:
- Identify the appropriate route. Establish whether the learner is a child using a proportionate process. Keep preliminary collection narrowly scoped. Part B of the Fourth Schedule contains a conditional exemption for confirming that a person is not a child and observing Rule 10 due diligence; it is not permission to activate unrelated tracking during signup.
- Bring the parent into the flow. Let the parent identify themselves and provide a way to establish the required identity and age details. Account for families who need assistance rather than making one app or device the only route.
- Explain the proposed processing. Show the data and purposes in clear language. Keep the child's learning service distinct from optional communications or other uses that need a separate assessment.
- Record the decision and activate permitted processing. Link the parent, child account, notice version, purposes, verification outcome and consent event. Limit access to the supporting evidence.
- Make withdrawal work. A withdrawal should reach the systems and processors relying on that consent. Explain what can no longer be provided and what records must be retained under applicable law.
This is a suggested implementation sequence. Rule 10 does not prescribe these five screens or require an arbitrary waiting period after verification succeeds.
Review analytics event by event
“Learning analytics” can mean anything from saving the current lesson to building a profile of a child's behaviour across products. The label is too broad for a legal or engineering decision.
Use an event review with the product and engineering teams. These examples illustrate the questions to ask; they are not blanket approvals or prohibitions for a particular tool.
| Proposed event or feature | What to examine | Practical design response |
|---|---|---|
| Store answers so a learner can resume a lesson | Purpose, necessity, consent route and any applicable exemption | Keep the record within the learning service and define its retention |
| Recommend exercises from a learner's performance history | Whether it involves tracking or behavioural monitoring; whether an exemption's conditions cover it | Document the assessment before enabling personalisation for children |
| Send an error report to a crash service | Whether the payload contains account IDs, lesson content or other personal data | Inspect real payloads and remove unnecessary fields |
| Send student identifiers to an ad platform | Tracking, targeted advertising, third-party reuse and the child's well-being | Remove or redesign the use where no applicable legal route exists |
| Share class progress with a teacher | The school's role, authorised recipients and exposure of other children's records | Restrict access to the relevant class and teacher; test permissions |
| Publish statistics about learning outcomes | Whether individuals remain identifiable, including within small groups | Aggregate carefully and assess re-identification risk before publication |
Removing a name does not necessarily make an event anonymous. A persistent account ID or a combination of school, class and behaviour can still relate to an identifiable child.
Ask the team to inspect what leaves the browser or app before consent, after consent and after withdrawal. A privacy policy that says tracking is disabled will not stop an SDK initialising on the first screen.
Work through one account from enrolment to closure
Imagine a school buys a platform for a term. A teacher imports a class list, pupils complete assignments, a parent asks to correct a record, and the school later changes suppliers.
At enrolment, the school and vendor should already have settled their roles, purposes and instructions. Check whether the class import includes unnecessary details. The platform may need a pupil identifier and class assignment without needing every field in the school's admission file.
During lessons, access should follow the educational relationship. A teacher should not automatically see records from every school using the platform. Support access needs a reason and an audit record. Student progress should not silently become material for an unrelated commercial use.
When a request arrives, establish who is asking and what authority they have. A parent's request can involve records containing information about classmates or another family member. Retrieve and review the relevant information before releasing it. The DSR portal guide covers verification, task tracking and response evidence.
At the end of the term, separate the school's records from the vendor's copies and legal-retention duties. Agree what is returned, what is erased, what must be retained and which party carries out each action. Rule 8(3)'s minimum one-year retention requirement for covered processing data and logs needs to be included in that assessment when it commences. An expired school contract does not, by itself, answer every retention question.
The useful deliverable is a short exit plan with named owners and evidence of completion. “The school is responsible” is not enough when the vendor still holds live student accounts.
What changes when the learner turns 18?
The child-specific provisions cease to apply by reason of age once the individual is 18. Plan for that transition in the account model rather than leaving parental controls in place indefinitely.
Review the notice, consent basis, account ownership and the parent's continuing access. Where consent is needed for ongoing or new processing, provide the adult learner with a direct choice. Do not assume that an earlier parental account arrangement authorises every future use or continued disclosure to the parent.
You do not need to turn a birthday into a demand to upload another identity document automatically. Choose a proportionate transition process and record the decisions it supports.
A release checklist the team can use
Before rolling out the revised student experience, check these behaviours with representative test accounts:
- A child cannot bypass the required consent route by following a deep link or using a different signup method.
- Optional SDKs do not begin disallowed processing while the parent is still completing verification.
- The consent record resolves to the correct child, parent, purpose and notice version.
- A teacher in one school cannot retrieve another school's records.
- Withdrawal changes the relevant processing and reaches the processors involved.
- An exemption is applied only to the documented activity and conditions.
- Account closure and retention jobs preserve required records while restricting their use.
- A learner turning 18 has a workable route to control their own account and privacy choices.
Assign each check to an owner. Product decides the intended behaviour, engineering verifies the data flow, and legal or privacy review establishes the applicable requirement. Keeping all three views together is more useful than treating compliance as a final review of the privacy policy.
Frequently asked questions
The main DPDP business duties discussed below are scheduled to commence in May 2027 under the government's commencement notification. Existing sectoral and cybersecurity requirements operate on their own timelines.
Who counts as a child under the DPDP Act?
The DPDP Act defines a child as an individual who has not completed 18 years of age. A 17-year-old learner is therefore a child even if they choose a course, have their own phone or pay for it themselves. The children's-data framework requires an assessment of parental consent and applicable exemptions, as well as the separate restrictions on harmful processing, tracking and advertising.
Sources: DPDP Act, Sections 2(f) and 9.
Is an OTP or a parent's payment enough to establish verifiable parental consent?
An OTP or payment does not, by itself, establish verifiable parental consent. An OTP shows control of a contact channel; a payment shows a transaction. Rule 10 calls for due diligence to establish that the person identifying themselves as the parent is an identifiable adult, using the permitted identity and age details or a qualifying token. The flow also needs to record consent for the child's specified processing.
Sources: DPDP Rules, Rule 10.
Are schools and EdTech companies exempt from the children's-data rules?
The educational exemption is conditional, rather than a blanket exemption for schools or EdTech. Rule 12 and the Fourth Schedule cover qualifying educational institutions, with processing restricted to tracking and behavioural monitoring for their educational activities or the safety of enrolled children. Check both the entity and the activity. The EdTech label alone does not decide eligibility, and Section 9(2)'s restriction on harm to a child's well-being remains.
Sources: DPDP Rules, Rule 12 and Fourth Schedule; DPDP Act, Section 9.
Can parental consent allow targeted advertising or behavioural tracking of children?
Parental consent does not override Section 9(3)'s restrictions on tracking, behavioural monitoring or targeted advertising directed at children. Any reliance on an exemption needs a separate check of its conditions. Permission to create a learning account is not permission to send student activity to an advertising audience. Review the actual SDK events and recipients, including events sent before signup is complete.
Sources: DPDP Act, Section 9; DPDP Rules, Rule 12 and Fourth Schedule.
Does parental verification require an Aadhaar copy from every family?
Rule 10 does not prescribe an Aadhaar copy from every family. It allows reference to reliable identity and age details already available to the fiduciary, voluntarily provided details, or a qualifying virtual token from an authorised entity. Choose a flow that meets the due-diligence requirement without defaulting to unnecessary document collection. Record the verification outcome and protect any supporting information you retain.
Sources: DPDP Rules, Rule 10.
What should an EdTech platform change when a learner turns 18?
Once a learner turns 18, the DPDP child-specific provisions no longer apply by reason of age. The platform should review account control, the processing basis and the parent's continuing access. Where consent is needed, give the adult learner a direct choice. Automatically carrying parental access and permissions forward can expose the learner's information beyond the arrangement they now want. This transition review is a practical design recommendation.
Sources: DPDP Act, Sections 2(f), 6 and 9.
What should you prioritise first?
Start with the student journey that collects the most data or involves the most third parties. Resolve its role assessment, exemption position, parental-consent flow and analytics behaviour before copying the design across the product.
The Act's Schedule provides a penalty ceiling of ₹200 crore for breach of the children's-data obligations, with actual penalties assessed under the statutory framework. That is a reason to make the assessment concrete, not to multiply the ceiling by the number of student accounts.
For a wider comparison, see how DPDP obligations differ across industries. If you want to connect your findings to assigned work and supporting evidence, book a ComplyZero walkthrough. ComplyZero is a DPDP compliance platform for Indian businesses, built by data protection lawyers and cybersecurity experts.
This article is for informational purposes and reflects the DPDP Act 2023 and DPDP Rules 2025 as understood at the time of writing. For guidance specific to your business, we recommend consulting a qualified data protection professional.
