EdTech and Education

Educational institutions and EdTech platforms process personal data of students, parents, and educators - including academic records, attendance, behavioural analytics, learning progress, and communication data. A significant portion of this data relates to children (persons under 18), making the DPDPA's children's data provisions particularly relevant. The rapid adoption of digital learning platforms during and after the pandemic has dramatically increased the volume of student data being processed digitally, bringing EdTech squarely within the DPDPA's scope.

Section 9 (Children's Data): EdTech platforms and schools processing data of students under 18 must comply with strict children's data requirements. Educational institutions are exempt from verifiable parental consent under Rule 12 only where the processing is solely for fulfilling educational purposes and is in the interest of the safety of the child. It is not a blanket exemption for all data processing within a school. Section 5-6 (Consent): EdTech platforms that are not classified as "educational institutions" under Rule 12 must obtain verifiable parental consent for processing children's data. Under Rule 12, exempted educational institutions can engage in tracking or monitoring where it is necessary for safety or educational purposes (e.g., attendance tracking or proctoring). Commercial EdTech, however, remains strictly prohibited from tracking, behavioural monitoring, and targeted advertising directed at children. Section 7 (Legitimate Uses): Section 7 (Legitimate Uses) does not explicitly list "educational purposes" as a general ground. While Section 7(b) covers "State functions" (which can apply to Government schools), private institutions must rely on the Rule 12 Exemption or Section 9(1) Consent. Relying on a vague "legitimate use" for education is a risky legal interpretation. Rule 8 (Data Retention): EdTech platforms classified as online platforms with the prescribed user thresholds face a 3-year retention period from last interaction. Educational institutions should establish retention policies aligned with academic record-keeping requirements.

1. Children's Data Classification: Determine whether all students are treated as children (under 18) and implement appropriate safeguards. Adult learners on EdTech platforms require different consent mechanisms. 2. Rule 12 Exemption: Educational institutions are exempt from verifiable parental consent, but EdTech platforms operating independently of educational institutions may not qualify. Assess your entity's classification carefully. 3. Tracking and Analytics: Learning analytics that track student behaviour, engagement, and performance must not constitute prohibited tracking or behavioural monitoring of children. Design analytics to focus on educational outcomes rather than behavioural profiling. 4. Advertising Restrictions: Targeted advertising directed at students identified as children is prohibited. EdTech platforms relying on ad-supported business models must implement controls to prevent targeted advertising to minors. 5. Data Sharing: Sharing student data with third parties (publishers, analytics providers, assessment platforms) requires careful consent management and contractual safeguards. 6. Parental Access: While the DPDPA grants rights to Data Principals, parents exercise rights on behalf of children. Implement mechanisms for parents to access, correct, and request erasure of their children's data.

*Note: This checklist is interpretive guidance derived from the DPDPA's general provisions (Sections 5-6, 7, 8-9, Rules 6, 8, 10-12, 14). It should be validated by legal counsel for your specific organisational context.* • Classify your entity - educational institution vs. EdTech platform for Rule 12 exemption • Implement age verification mechanisms for student users • Design learning analytics to avoid prohibited tracking of children • Disable targeted advertising for users identified as minors • Establish parental consent and access mechanisms • Review data sharing agreements with publishers and assessment platforms • Implement security safeguards for student data per Rule 6 • Define data retention policies for academic records • Establish grievance redressal mechanism per Rule 14 • Train educators and administrators on DPDPA data handling obligations