Edtech's New Classroom Rules: Navigating Minors' Data Under DPDPA
India’s vibrant edtech sector, a global leader in online learning, now operates under the comprehensive framework of the Digital Personal Data Protection Act, 2023 (DPDPA). As of October 2026, with the Act fully operational and the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarifying key aspects like consent mechanisms and data audit requirements, edtech platforms face stringent obligations, particularly concerning the data of minors. The DPDPA marks a pivotal shift, demanding a fundamental re-evaluation of data practices for any platform catering to India’s vast student population.
The DPDPA’s Stance on Minors: A Strict Approach
The DPDPA adopts a highly protective stance towards minors, defined as individuals under 18 years of age. Section 9(1) unequivocally mandates that Data Fiduciaries must obtain verifiable consent from a parent or lawful guardian before processing any personal data belonging to a minor. This differs significantly from privacy frameworks like the GDPR, which allows member states to set the age of digital consent as low as 13 years. India’s blanket 18-year threshold places a heavier burden on edtech companies, requiring them to implement robust age verification and parental consent mechanisms for all users below this age.
Furthermore, Section 9(2) imposes strict prohibitions on processing minors’ data in ways that could be detrimental to their well-being. Specifically, it forbids tracking, behavioural monitoring, and targeted advertising directed at children. This directly impacts many common edtech business models that rely on user analytics for personalised content delivery or advertising revenue. Platforms must meticulously design their services to avoid these prohibited activities when engaging with minor users, even if parental consent has been obtained for basic data processing.
Operationalising Verifiable Parental Consent
The core challenge for edtech platforms lies in effectively operationalising “verifiable consent” in an online environment. While the DPDPA itself lays down the principle, the anticipated Digital Personal Data Protection Rules (DPDP Rules) are expected to provide granular details on acceptable methods for verifying age and parental identity. The recent Digital Personal Data Protection (Removal of Difficulties) Order, 2026, while broadly clarifying consent provisions, underscores the need for sector-specific adaptations, which the edtech industry eagerly awaits.
Current best practices, even in the absence of explicit rules, suggest a multi-layered approach. This could involve combining self-declaration with secondary verification methods, such as linking to Aadhaar (with appropriate safeguards and consent), transactional verification (e.g., small credit card charge), or even video-based identity checks for parents. Simply clicking a checkbox is unlikely to meet the “verifiable” standard. Edtech platforms must also ensure that the consent sought is specific, informed, and unambiguous, as outlined in Section 7 of the DPDPA, and that parents can easily withdraw consent at any time.
Beyond Consent: Fiduciary Duties for Edtech
Obtaining consent is merely the first step. Edtech platforms, as Data Fiduciaries, bear a host of other responsibilities under the DPDPA. Section 8(5) mandates the implementation of “reasonable security safeguards” to protect personal data. Given the sensitive nature of academic and personal information pertaining to minors, edtech platforms are expected to deploy state-of-the-art encryption, access controls, and regular security audits to prevent data breaches. The consequences of a breach involving minors’ data could be particularly severe, both in terms of reputational damage and penalties.
Furthermore, the principles of purpose limitation (Section 6(1)) and data minimisation (Section 6(2)) are paramount. Edtech companies must only collect data that is strictly necessary for the stated purpose of providing educational services and must not retain data longer than required (Section 8(7)). This means re-evaluating analytics practices, student progress tracking, and even account retention policies. For significant data fiduciaries (as defined under Section 17), conducting Data Protection Impact Assessments (DPIAs) and appointing a Data Protection Officer (DPO) will be mandatory, offering an additional layer of accountability and risk management.
Navigating the Broader Regulatory Landscape
While the DPDPA is the primary legislation, edtech platforms must also consider other relevant Indian laws. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, for instance, require intermediaries to publish privacy policies and prohibit the hosting or publishing of information harmful to children (Rule 3(1)(b)). This complements the DPDPA’s protections by addressing content-related risks. Although currently, no specific sectoral regulator governs edtech, the Ministry of Education has previously issued advisories, indicating a growing focus on the sector. Future guidelines from such bodies could further refine DPDPA compliance requirements for educational technology providers.
Practical takeaway: Indian edtech businesses, their General Counsels, and Data Protection Officers must urgently review and overhaul their data processing practices. Prioritise implementing robust, verifiable age and parental consent mechanisms that go beyond simple checkboxes. Conduct thorough Data Protection Impact Assessments, especially for new features or data processing activities involving minors. Ensure strict adherence to purpose limitation, data minimisation, and data retention policies. Crucially, re-evaluate business models that rely on tracking, behavioural monitoring, or targeted advertising for minors, as these are now explicitly prohibited. Proactive compliance is not just a legal necessity but a strategic imperative to build trust and ensure sustainable growth in India’s evolving digital learning landscape.