DPDP for EdTech: Protecting Child Data Without Slowing Education

EdTech companies sit in the most exposed corner of the DPDP world. They handle child data, parent data, academic data, behavioural data, device data, and often payment data — all while trying to keep lessons simple, onboarding smooth, and product engagement high.

Under the Digital Personal Data Protection Act, 2023, any person under 18 is treated as a child, which means verifiable parental consent is required before processing their personal data. Tracking, behavioural monitoring, and targeted advertising to children are heavily restricted.

The good news is that compliance does not need to slow education down. Done well, it can reduce friction for parents, keep the product safe for children, and let your team focus on teaching instead of compliance firefighting.

---

Why EdTech Is the Most Sensitive DPDP Use Case

EdTech platforms are different from most SaaS products because the user is often a child, but the decision-maker is the parent. A typical EdTech stack may collect:

• Student name, age, and class level
• Parent phone number and email
• Academic performance and assessments
• Device and login data
• Class recordings and chat messages with teachers
• Attendance and behavioural metrics
• Payment and subscription records

If this data is scattered across spreadsheets and support inboxes, the platform is operating on borrowed time.

What DPDP Demands from EdTech

1. Verifiable parental consent

You cannot rely on a simple checkbox that says the child is over 18. You need a process that reasonably verifies the parent or guardian before processing begins.

2. Plain-language notice

Parents should understand what data is being collected, why it is needed, how long it is kept, and how they can withdraw consent or raise a grievance.

3. No unnecessary tracking

Tracking, profiling, behavioural monitoring, and targeted advertising to children should be avoided by default. If your product relies on analytics, keep it limited, justified, and child-safe.

4. Strong retention and deletion controls

Once a child leaves the platform or a parent withdraws consent, you should not keep the data indefinitely. Retention must be purposeful, documented, and limited.

5. Auditability

If a parent asks how consent was collected, what data was shared, or whether their child's information was deleted, you must be able to answer quickly and accurately.

---

What a Good EdTech Consent Flow Looks Like

Step 1 — Parent creates or approves the account

The account should either be created by the parent directly or linked to a parent approval step before the child can use it.

Step 2 — Clear notice before processing

The parent sees a short, readable explanation of what data will be collected and why it is needed.

Step 3 — Purpose-based consent

Split consent by purpose: account creation, course access, class communication, recorded sessions, progress reports, and marketing communication should each be separate.

Step 4 — Child-safe defaults

Analytics, recommendations, and promotional features should be restricted by default unless the platform has a clear, lawful reason to use them.

Step 5 — Parent dashboard

Parents should be able to review consent, manage settings, and request deletion or correction without emailing support repeatedly.

Step 6 — Centralised records

Log when consent was taken, what version of the notice was shown, who approved it, and what data was later accessed or deleted.

What EdTech Must Stop Doing

• Using one generic checkbox for everything
• Assuming a child can consent for themselves
• Keeping student data forever after course completion
• Using child data for marketing without clear parental approval
• Sending class recordings or student reports through unsecured channels
• Leaving access to child data open to too many internal users

A Simple Operating Standard

• Collect the minimum data needed to teach.
• Get parental consent before processing child data.
• Turn off tracking and advertising by default.
• Keep clear records of consent and deletion.
• Make privacy management simple for parents.

If a feature does not help learning, safety, or legal operation, it should not be the default.

---

This is the sixth blog in the SecureConsent DPDP series. Start from the beginning: What Is DPDP? A Guide for SMBs →