DPDP Act for Schools & Coaching Centres: Children's Data Rules

Last updated: 26 October 2026

Schools, coaching centres, tuition institutes and edtech businesses collect data about children. Under India’s DPDP Act, 2023, anyone under 18 is a child, and their data comes with the strictest rules in the law. Most duties apply from 13 May 2027.

The special rules for children’s data

1. Verifiable parental consent. Before processing a child’s personal data, you need consent from a parent or lawful guardian, and you must take reasonable steps to check that the person consenting really is the parent.
2. No tracking or targeted advertising. You must not track or monitor children’s behaviour, or target ads at them.
3. No processing likely to harm a child’s well-being.

The DPDP Rules give limited relief to educational institutions for some of these duties. For example, they can monitor behaviour where it’s needed for education or for children’s safety. The relief is tied to specific purposes, so check that what you do actually fits. Marketing to students is not covered.

Breaking the children’s-data rules can attract penalties of up to ₹200 crore.

Where student data spreads

• Admission and enquiry forms, online and on paper later typed into Excel.
• WhatsApp groups where phone numbers and photos of students and parents are visible to everyone.
• Apps and learning platforms with analytics and ad trackers.
• Websites showing student photos, results or toppers’ details without consent.
• Shared staff logins to the school management software.

Checklist for schools and coaching centres

• ☐ Parental consent built into admission forms, with records kept
• ☐ Privacy notice for parents in plain language (English plus the local language)
• ☐ No advertising or analytics trackers on student-facing apps and pages, unless clearly covered by an exemption
• ☐ Consent before publishing student photos or results
• ☐ WhatsApp communities or broadcast lists instead of open groups
• ☐ Individual staff logins and two-factor login for admin accounts
• ☐ Website fully on HTTPS, with secure forms
• ☐ Delete data of students who left, once you no longer need it
• ☐ A one-page 72-hour breach plan

Check your website first

Our free DPDP Security Check shows in 30 seconds whether your website loads trackers without consent, links a proper privacy notice, and protects the data parents type into your forms.