Navigating the Digital Classroom: DPDPA and Minors' Data in Indian Edtech
The Indian edtech sector, a dynamic frontier of innovation, has fundamentally reshaped learning. However, its rapid expansion, particularly in services catering to children, places it squarely under the microscope of India’s Digital Personal Data Protection Act, 2023 (DPDPA) and the subsequent DPDP Rules, 2025. With September 2026 upon us, compliance is no longer a theoretical exercise but an urgent operational imperative, especially when dealing with the sensitive personal data of minors.
The DPDPA’s Protective Shield for Children
The DPDPA explicitly carves out a robust framework for safeguarding the personal data of children, defined as individuals under the age of eighteen years (Section 2(c)). This definition aligns with the age of majority in India, setting a clear, unambiguous threshold. The foundational principle is enshrined in Section 9(1), which mandates that a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian before processing any personal data of a child. This is a significant departure from the more flexible age of consent seen in some global regimes like GDPR, where member states can set the age between 13 and 16. India’s approach prioritises parental oversight, recognising children’s limited capacity to fully comprehend data processing implications.
The DPDP Rules, 2025, further elaborate on the mechanisms for obtaining and verifying this consent. Edtech platforms are now expected to implement robust systems not only to secure consent but also to reasonably verify the age of the child and the identity of the consenting parent or guardian. This presents a practical challenge in a diverse digital landscape, requiring innovative yet secure solutions that don’t overly burden access to education while maintaining privacy standards.
Strict Prohibitions and Enhanced Obligations for Edtech
Beyond the requirement for parental consent, the DPDPA imposes stringent restrictions directly impacting edtech operations involving minors. Section 9(3) unequivocally prohibits Data Fiduciaries from undertaking any processing of a child’s personal data that is “likely to cause harm to a child.” This broad provision covers a range of activities, including behavioural monitoring, targeted advertising, and any processing that could lead to psychological distress, exploitation, or discrimination. For edtech companies, this means a fundamental re-evaluation of their business models that rely on profiling or personalised ad delivery to children.
Furthermore, Section 9(4) specifically forbids processing personal data of a child for any purpose detrimental to their well-being. This provision extends the protective umbrella, urging edtech platforms to consider the broader impact of their data practices on a child’s development and safety. The Data Protection Board of India (DPBI), established under Section 18, holds significant powers to investigate non-compliance and issue directives, including those specifically tailored to protect children. Large edtech platforms, likely to be designated as “Significant Data Fiduciaries” under Section 10 due to the volume and sensitivity of data processed, will face even more stringent obligations, including appointing an independent Data Protection Officer and conducting regular Data Protection Impact Assessments.
Intersecting Regulations and Operational Challenges
The DPDPA does not operate in a vacuum. Edtech companies must also contend with the existing Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules, 2021), particularly Rule 3, which mandates due diligence for intermediaries. This includes ensuring terms of service and privacy policies clearly outline data practices and comply with applicable laws. While the IT Rules address broader online safety, DPDPA provides the specific legal framework for personal data protection. Harmonising these regulations requires a comprehensive legal and technical strategy.
The practicalities of age verification and verifiable consent remain a key challenge. In a country with varying levels of digital literacy and access, methods must be effective without creating undue barriers to legitimate educational access. Edtech platforms must balance privacy protection with user experience, potentially leveraging solutions like Aadhaar-based verification (with appropriate safeguards) or other robust digital identity mechanisms, all while respecting the principles of data minimisation (Section 6(1)) and purpose limitation. Data retention (Section 8(7)) also becomes critical; data collected from minors should not be held indefinitely once the purpose of processing is served.
Practical Takeaway
Indian edtech businesses, their General Counsels, and Data Protection Officers must proactively re-engineer their data governance frameworks. This entails implementing robust, verifiable parental consent mechanisms for all child users, moving beyond simple click-through agreements. Critically, all forms of targeted advertising, behavioural monitoring, and profiling of minors must cease. Data minimisation should be a core design principle, collecting only what is strictly necessary for educational purposes. Comprehensive data security safeguards (Section 8(5)) are non-negotiable to protect sensitive student information. Regular privacy audits, staff training on DPDPA compliance, and clear, transparent privacy policies tailored for parents and children are essential. Engaging with the DPBI and anticipating future sector-specific guidelines will be key to sustainable growth in this heavily regulated domain.