Navigating Student Data: India's DPDPA in a Global Edtech Landscape
The rapid expansion of the edtech sector has brought with it an increased focus on the sensitive personal data of students. For companies operating or aspiring to operate across borders, understanding the nuances of different privacy regimes is critical. As of October 2026, India’s Digital Personal Data Protection Act (DPDPA), complemented by sector-specific regulations, provides a robust framework that merits comparison with established global benchmarks like the US’s Family Educational Rights and Privacy Act (FERPA) and the EU’s General Data Protection Regulation (GDPR).
Scope and Applicability: Defining the Data and the Entity
India’s DPDPA casts a wide net, applying to the digital processing of “personal data” within India or to data principals located in India for offering goods or services (Section 3). This explicitly covers edtech companies as “Data Fiduciaries” processing student data. Crucially, DPDPA Section 10 defines “children” as individuals under 18 years of age, imposing specific obligations for their data.
In contrast, FERPA’s scope is narrower, focusing primarily on “educational agencies and institutions” that receive funds from the U.S. Department of Education. It protects “education records” (20 U.S.C. § 1232g(a)(4)), which are records directly related to a student and maintained by an educational agency or institution. This means many independent edtech providers not directly funded by the Department of Education might fall outside FERPA’s direct purview, though they may be bound by contractual obligations to FERPA-compliant institutions.
GDPR, like DPDPA, is broad, applying to the processing of “personal data” of individuals in the EU, regardless of the processor’s location (Article 3). It doesn’t have a specific “student data” category but treats children’s data (under 16, though member states can lower to 13, Article 8) with enhanced protections.
Comparative insight: DPDPA and GDPR offer a more comprehensive, entity-agnostic approach to personal data protection, including student data, compared to FERPA’s institution- and record-specific focus. DPDPA’s definition of a “child” (under 18) is notably stricter than GDPR’s general threshold (under 16) and FERPA’s implicit focus on K-12 and higher education students without a specific age for “child” status.
Consent and Lawful Basis for Processing
Under DPDPA, processing personal data requires clear, affirmative consent for a specified purpose (Section 7). For children’s data, DPDPA Section 10(1) mandates verifiable parental consent, with strict prohibitions on tracking, behavioural monitoring, or targeted advertising. This is a high bar for edtech platforms.
FERPA generally requires written parental consent (or eligible student consent) before disclosing “personally identifiable information” from education records (20 U.S.C. § 1232g(b)(1)). However, it includes numerous exceptions, such as disclosures to school officials with a “legitimate educational interest” or for directory information, which can be disclosed without consent if parents are given notice and an opportunity to opt out. Consent under FERPA is primarily for disclosure, not necessarily all forms of data processing.
GDPR requires a lawful basis for processing (Article 6), with consent being one of six options. For “information society services” offered directly to a child, parental consent is required if the child is below the national age of digital consent (Article 8). However, other lawful bases like legitimate interest or contractual necessity may apply for certain processing activities, provided they are balanced against the child’s rights.
Comparative insight: DPDPA’s explicit requirement for verifiable parental consent for all processing of children’s data, coupled with prohibitions on specific activities, makes it potentially the most stringent in terms of consent for minors in the edtech context. FERPA’s consent requirements are primarily disclosure-focused with significant exceptions, while GDPR offers more flexibility in lawful bases beyond consent, though child data still receives enhanced protection.
Data Minimisation, Retention, and Security
DPDPA mandates purpose limitation and data minimisation (Section 6(1)), requiring data fiduciaries to collect only data necessary for the specified purpose. It also requires reasonable security safeguards (Section 9) and limits data retention to the period necessary for the stated purpose (Section 8(7)).
GDPR similarly emphasizes data minimisation (Article 5(1)(c)), purpose limitation (Article 5(1)(b)), and storage limitation (Article 5(1)(e)). Article 32 requires data controllers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
FERPA, while requiring institutions to protect education records, does not explicitly prescribe data minimisation principles or specific retention periods in the same prescriptive manner as DPDPA or GDPR. Security is implied but not detailed through specific technical requirements in the statute itself.
Comparative insight: DPDPA and GDPR are significantly more prescriptive regarding data minimisation, purpose limitation, and explicit security obligations. FERPA is comparatively less detailed on these operational aspects, often leaving implementation to institutional policy.
Overlapping Indian Regulations: RBI and IT Rules
Beyond DPDPA, edtech companies in India must also contend with other regulatory frameworks. The Reserve Bank of India (RBI) issues directives, particularly concerning payment systems and data localization for financial transactions. For edtech platforms collecting fees, RBI’s regulations on payment aggregators and data storage can impose strict requirements on data security and where financial data is stored, often mandating storage within India.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, while not a general privacy law, apply to edtech platforms that function as “intermediaries.” These rules impose due diligence obligations, content moderation requirements, and grievance redressal mechanisms that can indirectly impact how student data, especially user-generated content, is handled.
Comparative insight: The layered regulatory environment in India, with DPDPA, RBI, and IT Rules, presents a unique compliance challenge. While GDPR has sector-specific regulations (e.g., e-Privacy Directive) and FERPA interacts with financial aid regulations, the explicit data localization and intermediary liability aspects seen in India’s RBI and IT Rules add distinct layers of complexity not directly mirrored in the general privacy statutes of FERPA or GDPR.
Practical Takeaway
Indian edtech businesses, GCs, and DPOs must adopt a “privacy-by-design” and “by-default” approach, particularly given DPDPA’s strictures on children’s data and consent. A comprehensive data mapping exercise is crucial to identify all personal data processed, its purpose, and retention periods. When operating globally, assume the highest common denominator of compliance requirements, especially concerning verifiable parental consent for minors, robust data minimisation, and stringent security measures. Furthermore, do not overlook the specific obligations imposed by RBI for financial data and the IT Rules for platform operations, as these add significant layers to the Indian compliance landscape.