EdTech
DPDP Compliance for EdTech Platforms
In May 2026, the NHRC issued show-cause notices to major EdTech platforms over algorithmic exploitation of minors and the absence of verifiable parental consent. For this sector, enforcement is not a 2027 concern. Platforms serving users under 18 trigger the DPDP Act's Section 9 children's data protections, which require verifiable parental consent and prohibit behavioural monitoring of minors.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- Penalty ceiling for the children's data obligations, Section 9
- 200 Cr
- Maximum penalty under the DPDP Act
- 250 Cr
Obligations
Your DPDP Obligations as a EdTech Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to edtech operations.
Ref 01
Verifiable Parental Consent
Section 9 requires verifiable consent from a parent or lawful guardian before processing any data of individuals under 18. Self-declaration is insufficient.
Ref 02
No Behavioural Monitoring
Section 9 prohibits tracking, profiling, or behavioural monitoring directed at children. Engagement analytics, personalised recommendations, and adaptive learning may require restructuring.
Ref 03
No Targeted Advertising
Advertising directed at children based on their personal data is prohibited. Revenue models dependent on targeted ads to minor users need alternative approaches.
Ref 04
Data Principal Rights
Parents exercise rights on behalf of minors under Sections 11-14. Access, correction, and erasure requests may come from parents, not the student users.
Ref 05
Purpose Limitation
Student data collected for education delivery cannot be repurposed for marketing, research, or product development without fresh parental consent.
Ref 06
Security Safeguards
Enhanced security measures are expected for children's data. Encryption, access controls, and data minimisation must reflect the sensitivity of minor user data.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
May 2026
NHRC notices issued
The National Human Rights Commission issued show-cause notices to major EdTech and AI platforms over exploitation of minors and missing verifiable parental consent. Regulatory scrutiny of children's data is active now.
Now
Identify minor user data
Determine which users are under 18 and map all personal data processing for this cohort.
Q3 2026
Parental consent system
Implement verifiable parental consent flow with age verification and guardian identity confirmation.
Q3 2026
Audit behavioural tracking
Review all analytics, personalisation, and adaptive learning features for Section 9 compliance.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for EdTech Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Growth for EdTech
Growth tier supports parental consent workflows and children's data segregation required by Section 9 for up to 500K student records.
₹1,25,000 one-time
- Up to 500K data principals
- Consent capture via API and dashboard, HMAC-signed
- Rights Management Portal
- Breach Incident Register
- Priority email support
Resources
Essential Reading for EdTech
The DPDP provisions that bear most on your sector, in detail.
Children's Data Protection: Parental Consent Under DPDP in India
Up to ₹200 crore. Section 9 of the DPDP Act bans tracking, behavioural profiling, and targeted ads aimed at under-18s, even with parental consent, and requires verifiable parental consent before any processing begins.
6 min read
Consent ManagementDPDP Consent Management: Technical Systems for Indian Businesses
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
7 min read
Data Principal RightsDPDP Act 2023: The Data Principal Rights with Templates (India)
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
7 min read
FAQ
EdTech compliance, answered.
What age threshold triggers children's data protections?
The DPDP Act sets the threshold at 18 years. Any individual under 18 is considered a child, and their data requires verifiable parental consent before processing.
Can we use adaptive learning if it involves behavioural monitoring?
Section 9 prohibits behavioural monitoring directed at children. Adaptive learning features that track and profile student behaviour may need to be restructured to use aggregated, non-identifiable data instead.
How do we verify parental consent?
From 13 May 2027, Section 9(1) and Rule 10 require verifiable consent of the parent or lawful guardian before a child's personal data is processed. Rule 10 requires the Data Fiduciary to check that the person identifying as the parent is an identifiable adult, by reference to reliable details of identity and age: details already held by the Data Fiduciary, or voluntarily provided details of identity and age, including those made available through a Digital Locker service. The Rules set the standard of verification, not a single method.
The NHRC has already issued notices to EdTech platforms. What does that mean for us?
In May 2026, the National Human Rights Commission issued show-cause notices to major EdTech and AI platforms over algorithmic exploitation of minors and the absence of verifiable parental consent. This is active regulatory scrutiny, separate from the DPDP penalty timeline. The defensible position is documented evidence: a verifiable parental consent record for every minor user, a record of restricted behavioural processing, and an audit trail you can produce on request. ConsentOS installs this infrastructure.
Section 9 requires verifiable parental consent. Self-declaration is not it.
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.