The DPDP exemption for schools and universities covers tracking and behavioural monitoring, not every use of a student's data

From 13 May 2027, section 9 of the Digital Personal Data Protection Act, 2023 requires verifiable consent of a parent before any personal data of a child, anyone under eighteen, is processed, and bars tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 of the Digital Personal Data Protection Rules, 2025 lifts both duties for an educational institution, but only for tracking and behavioural monitoring for its educational activities or for the safety of children enrolled with it. Admission, fee and examination records sit outside that condition on any ordinary reading, and neither section 9(4) nor rule 12 lifts the bar on detrimental processing.

What changes on 13 May 2027?

Two instruments were published in the Gazette of India on 13 November 2025. G.S.R. 843(E) appointed the dates on which the Act comes into force, and clause (c) brings sections 7 to 10, among others, into force eighteen months from publication. G.S.R. 846(E) made the Rules, and rule 1(4) brings rules 3, 5 to 16, 22 and 23 into force eighteen months after publication. Eighteen months from 13 November 2025 is 13 May 2027. Section 9 of the Act, rule 10 on how a parent's consent is verified, and rule 12 with the Fourth Schedule on the exemptions all start on that one day.

Section 9 has five sub-sections. Sub-section (1) requires a data fiduciary, before processing any personal data of a child, to obtain the verifiable consent of the parent, in the manner prescribed. Sub-section (2) forbids processing that is likely to cause any detrimental effect on the well-being of a child. Sub-section (3) forbids tracking or behavioural monitoring of children and targeted advertising directed at children. Sub-section (4) allows classes of data fiduciaries, or purposes, to be taken out of sub-sections (1) and (3), on conditions to be prescribed. Sub-section (5) lets the Central Government notify, for a data fiduciary whose processing is verifiably safe, an age above which it is exempt from all or any of the obligations in sub-sections (1) and (3).

Section 3(a) applies the Act to personal data collected in digital form and to data collected on paper and digitised later. A register left on paper is outside it. Once scanned into a student information system, it is not.

Who counts as a child on a campus?

Section 2(f) defines a child as an individual who has not completed the age of eighteen years, and rule 10(2)(a), for that rule, defines an adult as one who has. For a school, almost every student is a child. For a university or a college, the point is less obvious: a first-year undergraduate admitted at seventeen is a child under the Act until her eighteenth birthday.

Section 2(j) adds that where the data principal is a child, the expression includes the child's parents or lawful guardian, and the Explanation to section 9(1) reads consent of the parent as including that of a lawful guardian.

An illustration. The dates are hypothetical. The rules are the Act's.

A student born on 2 September 2009
  Enrolment, 1 July 2027         a child, section 2(f)
  Completes eighteen years       2 September 2027
  From that day                  no longer a child, section 2(f)

For the two months between enrolment and her birthday, a university that processes her data in digital form needs her parent's verifiable consent, unless the Fourth Schedule exempts what it is doing.

How is a parent's consent verified?

Rule 10(1) requires a data fiduciary to adopt appropriate technical and organisational measures to ensure that the parent's verifiable consent is obtained before any processing. It must also observe due diligence to check that the individual identifying herself as the parent is an adult who is identifiable, if required in connection with compliance with any law. That check is made against one of two things: reliable details of identity and age already available with the data fiduciary, or details provided voluntarily, either by the individual or through a virtual token mapped to those details and issued by an authorised entity. Details or tokens verified by a Digital Locker service provider are expressly included.

The illustration to rule 10 is written for an account on an online platform, and its four cases turn on one fact: whether the data fiduciary already holds the parent's identity and age details. On the same logic, a school that already holds reliable identity and age details of a parent from admission could check against its own records, while a platform that meets the parent for the first time at sign-up would check against details issued by an entity entrusted by law or the Government, or a token mapped to them.

What does the exemption for educational institutions cover?

Rule 12(1) says that sub-sections (1) and (3) of section 9 do not apply to processing of a child's personal data by the classes of data fiduciaries in Part A of the Fourth Schedule, subject to the conditions stated there. Item 3 of Part A is a data fiduciary who is an educational institution. The condition is that processing is restricted to tracking and behavioural monitoring for the educational activities of the institution, or in the interests of safety of children enrolled with it.

The Note to the Schedule says that an educational institution "shall mean and include an institution of learning that imparts education, including vocational education". A school, a college, a university and a vocational institute all read naturally into those words.

Two neighbouring items matter on a campus. Item 4 covers an individual in whose care infants and children in a crèche or child day care centre are entrusted, for tracking and behavioural monitoring in the interests of their safety. Item 5 covers a data fiduciary engaged by an educational institution, crèche or child care centre to transport children enrolled with it, restricted to tracking their location, in the interests of their safety, during travel to and from the institution.

On the text of the condition in item 3, the exemption reaches processing that is tracking or behavioural monitoring and nothing wider. Admission forms, fee records, examination results, transcripts, hostel allotment and the data that runs a learning management system are not, on any ordinary reading, tracking or behavioural monitoring. For that processing, section 9(1) applies in full and the parent's verifiable consent is required, unless a purpose in Part B applies.

Neither section 9(4) nor rule 12 mentions sub-section (2). Outside the cases in section 17, the bar on processing likely to cause a detrimental effect on a child's well-being binds every data fiduciary, including an educational institution acting squarely within item 3.

Which purposes in Part B touch an institution?

Rule 12(2) lifts sub-sections (1) and (3) for the purposes in Part B, again on conditions. Six are listed. Items 2 to 6 are the ones most likely to arise in education, and item 1 may reach a public institution performing a function under law in the interests of a child.

Item 2 covers providing or issuing any subsidy, benefit, service, certificate, licence or permit under law or policy or using public funds, in the interests of a child, under section 7(b) of the Act, restricted to what is necessary for that purpose.

Item 3 is the creation of a user account for communicating by email, with processing restricted to what is necessary to create the account, and the use of the account limited to communication by email. A single sign-on account that also opens the learning platform, the library and the fee portal does more than communicate by email, and on the text falls outside it.

Item 4 is determining a child's real-time location, restricted to tracking it in the interest of her safety and protection or security. Item 5 is ensuring that information, a service or an advertisement likely to be detrimental to a child's well-being is not accessible to her, which is the most natural basis for content filtering on a school network. Item 6 is confirming that a data principal is not a child, and observing the due diligence in rule 10.

Where does an edtech company stand?

It depends on whose data fiduciary it is. Where a school or university engages a platform to process student data on its behalf, the platform is a data processor, and section 8(1) keeps the institution responsible for compliance in respect of any processing undertaken by it or on its behalf by a data processor. Section 8(2) permits that engagement, for any activity related to offering of goods or services to data principals, only under a valid contract. The duties in section 9 are addressed to the data fiduciary.

Where the platform deals with families directly, it is a data fiduciary in its own right. Whether it is then "an institution of learning that imparts education" for item 3 is a question the Rules do not answer. If it is not, sub-sections (1) and (3) apply to it without the Part A exemption: verifiable parental consent before any processing of a child's data, no tracking or behavioural monitoring of children, and no targeted advertising directed at children. None of the conditions in either Part of the Fourth Schedule permits targeted advertising by any data fiduciary.

Section 9(5) works by notification, not by rules, and the Rules set no age above which a verifiably safe data fiduciary is relieved of the consent or tracking duties.

What does a breach cost?

Item 3 of the Schedule to the Act sets a penalty that may extend to INR 200 crore for breach in observance of the additional obligations in relation to children under section 9. Under section 33(1), the Data Protection Board of India may impose it only if it determines, at the end of an inquiry, that the breach is significant, and only after hearing the person. The definition of "person" in section 2(s) includes a company, an association of persons or a body of individuals and every artificial juristic person, so the trustees of a trust, a society or a company running an institution are within it.

What remains unsettled?

Four points.

What an institution of learning is. The Note to the Fourth Schedule does not say whether a coaching centre, an online course provider or an edtech platform that sells directly to students qualifies.

What tracking and behavioural monitoring are. Neither the Act nor the Rules defines the phrase. Attendance systems, campus access logs, online proctoring and learning analytics may each be argued as tracking or monitoring for educational activities, or as ordinary processing that needs consent.

Whether a vendor shares the exemption. Item 5 names a transport provider engaged by an institution, and no other kind of vendor. One reading is that a data processor acting on the institution's behalf needs no exemption of its own, because section 9 binds the data fiduciary. Another is that the express mention of transport leaves other engaged parties outside Part A where they act as data fiduciaries themselves. The text does not settle it.

What happens to consent taken before 13 May 2027. Section 5(2) requires a notice, as soon as reasonably practicable, where a data principal gave consent before commencement. It does not say whether a parent's consent collected earlier, without the checks in rule 10, meets the verifiable standard in section 9(1) once that sub-section is in force.