Key Takeaways

  • Section 2(f) of the Digital Personal Data Protection Act 2023 treats anyone under eighteen as a child, so most school learners fall inside it.
  • Section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising directed at children.
  • Rule 10 of the DPDP Rules 2025 explains how a platform checks that the person consenting is an identifiable adult.
  • Rule 7 requires breach intimation to affected users and to the Data Protection Board, with a detailed report within seventy two hours.
  • Most of these rules take effect eighteen months after the November 2025 notification, which leaves a short runway for product changes.

Table of Contents

  1. Executive Summary
  2. Client Overview
  3. Business Challenges
  4. Business Objectives
  5. Solution Strategy
  6. Technologies and Tools Used
  7. Implementation Process
  8. Business Results
  9. Lessons Learned
  10. Frequently Asked Questions
  11. Conclusion

Executive Summary

A data privacy advisory service is most useful before the product ships, not after a complaint. This Kochi edtech came to us early. Its learners are mostly school students under eighteen. Under Indian law, that makes almost every account a child's account.

The Digital Personal Data Protection Act 2023 sets the obligations. The Digital Personal Data Protection Rules 2025 set the method. The Rules were notified in November 2025, and most of them take effect eighteen months later.

That timeline looked generous on paper. In practice it wasn't. Changing a signup flow, an analytics stack and an advertising setup takes real engineering time.

The platform had grown fast. Learners signed up themselves. Parents rarely appeared in the flow at all. Analytics tools profiled every session, and marketing ran retargeting campaigns across social platforms.

We ran a readiness programme in seven parts. Data mapping came first. Then a redesigned notice, a parental consent flow, and the removal of tracking aimed at children. Processor contracts, a breach drill and a grievance channel completed it.

The platform was ready ahead of the phased deadlines. It now knows what data it holds, why it holds it, and who consented.

Do you know how many of your users are under eighteen? Read our explainer on DPDP compliance and penalties, or write to TGC Legal.

Client Overview

The client is an online learning platform based in Kochi. It offers recorded lessons, live doubt clearing sessions and practice tests for school students in Kerala.

The company employs a few dozen people. Most sit in product, content and support. There is no in house lawyer, and privacy questions had always gone to the engineering lead by default.

Its learners range from upper primary to higher secondary. Almost all are under eighteen. A small group of adult learners prepare for entrance examinations, but they are the exception.

Revenue comes from subscriptions, usually paid by a parent. Yet the account belonged to the student. The parent appeared only at the payment screen, as a card holder rather than as a consenting adult.

The stack is typical for a young edtech. A mobile app and a web app, a cloud host, a video delivery service, a payment gateway, an analytics suite, a messaging tool and a customer support desk. Each of these handles personal data on the platform's behalf.

Nobody had ever drawn that picture in one place. That turned out to matter more than any single clause.

Is your edtech built around the learner's account rather than the parent's consent? Explore our privacy compliance work, or ask TGC Legal.

Business Challenges

The founders asked one question: what do the new rules mean for us? The honest answer was that they touched nearly every screen. Four problems stood out.

Who counts as a child under the DPDP Act 2023?

Section 2(f) of the Act defines a child as an individual who has not completed eighteen years. There is no lower tier for teenagers. A fifteen year old and a seventeen year old are treated the same way.

For this platform, that single definition changed the analysis. The founders had assumed that older students could consent for themselves. They can't, at least not for the purposes of this Act.

Section 9(1) requires the Data Fiduciary to obtain verifiable consent of the parent before processing any personal data of a child. So the learner's own tick box, however clear, does not satisfy the law. The parent's consent does.

Most of the platform's accounts had been opened by students on their own phones.

Can an edtech app track students' learning behaviour?

Section 9(3) says a Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. The Act does not define either phrase.

That silence creates real difficulty for an edtech. Some processing is simply the service. A test score must be recorded to show progress. Other processing is profiling. A model that predicts when a student will drop off, and pushes nudges, sits much closer to the prohibited line.

The platform used both kinds. Its analytics suite captured every tap, every pause and every exit. Marketing used those signals to build audiences on social platforms and retarget them.

We could not draw a precise line from the statute alone. So we chose a conservative reading and designed to it.

Does the educational institution exemption cover an edtech platform?

Probably not in the way the founders hoped. Rule 12 and Part A of the Fourth Schedule to the DPDP Rules 2025 relax Sections 9(1) and 9(3) for an educational institution.

That relaxation is narrow. It covers tracking and behavioural monitoring only for the institution's educational activities, or in the interests of safety of children enrolled with it. It says nothing about advertising.

The Schedule defines an educational institution as an institution of learning that imparts education, including vocational education. Whether a subscription app qualifies is an open question. No authority has answered it yet.

We advised the company not to build its compliance on that exemption. If it applied, it would be a bonus. If it didn't, the product would already be compliant.

Why was the existing privacy notice not enough?

The old notice was a long policy page copied from a foreign template. It referred to laws that do not apply in India, and it mixed every purpose into one paragraph.

Section 5 of the Act requires a notice that tells the Data Principal what personal data is processed and why. It must also explain how to withdraw consent, how to exercise rights, and how to complain to the Board. Section 5(3) adds a language option, in English or a language in the Eighth Schedule to the Constitution.

Rule 3 goes further. The notice must stand on its own, use clear and plain language, give an itemised description of the data, and describe the specific purposes.

The existing page met almost none of this. More importantly, no parent ever saw it.

Has your product team read Section 9 alongside your analytics setup? Read more on how we approach privacy compliance, or speak to TGC Legal.

Business Objectives

We agreed the objectives with the founders in a single working session. One assumption was dropped early: that compliance meant a new privacy policy.

What did the platform need to achieve before the deadline?

Four things, in order of difficulty. A parental consent flow that actually verified an adult. A product with no tracking or advertising aimed at children. A notice that a parent could read on a phone in a couple of minutes. And a working process for breaches and grievances.

The deadline was set by Rule 1 of the DPDP Rules 2025. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication in the Gazette. That covers notice, security safeguards, breach intimation, children's consent and the rights of Data Principals.

Product changes needed a full release cycle and a testing window. So the real deadline arrived months earlier than the legal one.

When does an edtech need a data privacy advisory service?

Usually earlier than it thinks. This platform called us because a school partner asked about DPDP readiness in a procurement form. That question exposed how little the team could answer.

Children's data raises the stakes. The Act treats breaches of children's obligations seriously, and parents notice quickly when something goes wrong.

Timing also shapes the cost. Consent and tracking decisions sit inside the product architecture. Changing them during a scheduled release is cheap. Changing them after a complaint, under pressure, is not.

We told the founders plainly that a policy rewrite would not be enough. The work had to reach the signup flow, the analytics settings and the vendor contracts.

Which commercial goals had to survive the changes?

Growth, mainly. The founders worried that a parental consent step would cut signups. Marketing worried about losing retargeting audiences.

We didn't dismiss those concerns. Instead, we treated them as design constraints. The consent step had to be short, mobile friendly and available in Malayalam as well as English. Marketing had to move towards parents, who are adults and who pay.

School partnerships also mattered. Schools increasingly ask vendors about data handling. A clear, documented programme would answer those questions before they were asked.

The objective was compliance that the business could live with, not compliance that sat in a drawer.

Planning your next release around the DPDP timeline? Explore our data privacy service, or contact TGC Legal.

Solution Strategy

The strategy was simple to state. Know the data first, then move consent to the parent, then strip out anything that profiled a child for reasons other than teaching.

Every step was mapped to a section of the Act or a rule. That kept the work grounded, and it gave the founders a clear reason for each change.

How do you start DPDP data mapping for an edtech?

With a register, built system by system. For each tool we recorded what personal data it held, whose data it was, why it was collected, where it was stored and who could reach it.

The register covered the app, the web platform, the video service, the payment gateway, the analytics suite, the messaging tool and the support desk. It also captured spreadsheets kept by the sales team, which nobody had listed.

Two findings shaped everything after. First, the analytics suite collected device identifiers and detailed event data for every learner. Second, the support desk held old chat transcripts with names, schools and phone numbers, and no deletion schedule.

The register became the backbone of the notice, the contracts and the breach plan.

How should verifiable parental consent work in an app?

Rule 10 gives the method. The Data Fiduciary must take appropriate technical and organisational measures to obtain verifiable consent of the parent before processing a child's data.

It must also check that the person identifying as the parent is an adult who is identifiable. That check can rely on reliable identity and age details already held, or on details voluntarily provided. Those details can come directly or through a virtual token issued by an authorised entity, including through a Digital Locker service provider.

We designed the flow around the Rule's own illustrations. A student begins signup and names a parent. The parent then completes a short step on their own device, and the platform verifies age before the student's profile is created.

Where a parent was already a paying customer with verified details, the check drew on what the platform held.

What counts as tracking or targeted advertising directed at children?

Since the Act gives no definition, we built a working test. Processing stays if it is necessary to deliver the lesson the student chose. Processing goes if it predicts, profiles or persuades beyond that.

Under that test, test scores, lesson progress and attendance in live sessions stayed. Cross session behavioural profiles, engagement prediction scores and push nudges built on them were switched off for child accounts.

Advertising was clearer. Retargeting pixels and social audience sharing were removed for all child accounts. Marketing now speaks to parents, through channels where the audience is adult.

We documented the test and the reasoning behind each call. If the Board or a court later reads the section differently, the company can show a considered position rather than an accident.

How was the privacy notice redesigned for parents?

We started again rather than editing the old policy. Rule 3 requires an itemised description of the data and the specific purposes, so we wrote the notice from the data register.

The parent notice now lists each category of data, the reason for it, and the service it enables. It then explains how to withdraw consent, how to exercise rights, and how to complain to the Data Protection Board of India.

Withdrawal had to be as easy as giving consent, as Section 6(4) requires. So the withdrawal option sits in the parent dashboard, one tap away, not inside an e mail chain.

A Malayalam version was prepared alongside the English one, consistent with the language option in Section 5(3).

Would a parent understand your privacy notice on a phone screen? Read our guide to consent notices for SaaS products, or talk to TGC Legal.

Technologies and Tools Used

Most of the work was contractual and procedural. The technology changes were modest, but they had to be precise.

Which vendors count as Data Processors under the DPDP Act?

Any vendor that processes personal data on the platform's behalf. Here that meant the cloud host, the video service, the messaging tool, the support desk and the analytics suite.

Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract. Section 8(1) keeps the Fiduciary responsible for everything the Processor does on its behalf.

Rule 6(1)(f) adds that the contract should provide for reasonable security safeguards. So we reviewed each vendor agreement against a short checklist covering security, breach notice to the platform, deletion on termination and the limits of permitted use.

Two vendors used standard terms that the platform could not negotiate. In those cases we documented the gap and adjusted the configuration instead.

How were analytics and consent records configured?

Analytics was split into two profiles. Child accounts send only the events needed to show learning progress. Adult accounts, mostly parents, follow the normal configuration with their own consent.

Device identifiers for advertising were blocked at the software level for child accounts. We confirmed this with a test build rather than relying on a vendor's assurance.

Consent records now capture who consented, when, through which notice version, and how age was verified. That record matters later, because it is the evidence of compliance.

Rule 8(3) and Rule 6 also call for logs. The platform now retains processing logs for the minimum period the Rules specify.

What documentation supports the programme?

A data register, a consent design note, a tracking and advertising position paper, the parent notice in two languages, a breach response plan and a grievance procedure.

Each document is short. The position paper on tracking runs to a few pages and explains the working test with examples from the product.

We also prepared a one page summary for school partners. It answers the questions schools now ask in vendor forms, without exposing internal detail.

The documents name owners. A plan without a named owner tends to fail on the first busy day, and breaches rarely arrive on quiet ones.

Implementation Process

The programme ran across two product release cycles, with legal and engineering working from the same register throughout.

How long does DPDP readiness take for a small edtech?

Longer than a policy rewrite and shorter than most founders fear. The legal analysis was quick. The product changes set the pace.

We front loaded the decisions. Data mapping, the tracking position and the consent design were settled before engineering started. That avoided the common pattern where developers build, lawyers object, and the sprint is lost.

Each release carried a defined set of changes. The first carried the consent flow and the analytics split. The second carried the notice, the dashboard controls and the grievance channel.

Vendor contract work ran in parallel and did not depend on the releases.

How were existing student accounts moved to parental consent?

This was the most delicate step. Most accounts had been opened by students before any parent was involved.

We designed a reconsent campaign aimed at parents. Students saw a simple prompt asking them to invite a parent. Parents received a link, read the new notice and completed the verification step.

Section 5(2) of the Act deals with consent given before commencement. It requires a notice as soon as reasonably practicable and allows processing to continue until consent is withdrawn. We treated that as a floor, not a goal, because Section 9 makes the parent's consent central for children.

Accounts without parental consent after a reasonable window were moved to a restricted mode, with progress data preserved.

How do you run a personal data breach drill?

As a tabletop exercise built on a plausible scenario. Ours assumed that a support desk export containing student names and phone numbers had been shared by mistake.

Rule 7 sets the steps. Each affected Data Principal must be told without delay, in plain language, what happened, the likely consequences, the mitigation and the safety steps they can take. The Board must receive an initial intimation without delay and a detailed report within seventy two hours, unless it allows longer on a written request.

For child accounts, the team agreed to write to the parent. The drill tested who drafts the message, who approves it, and who files with the Board.

The drill exposed one gap. Nobody knew who could pull the list of affected users quickly. That owner is now named.

What does grievance redressal under the DPDP Rules require?

Section 8(10) requires an effective mechanism to redress grievances. Section 8(9) and Rule 9 require the business contact information of a person who can answer questions about processing to be published prominently.

Rule 14(3) requires the Fiduciary to publish the period for responding to grievances, which cannot exceed ninety days. We recommended a much shorter internal target, because parents expect quick answers.

The channel sits in the parent dashboard and on the website. Requests to access, correct or erase data route to a single queue, with a named owner and a log.

Support staff were briefed on how to recognise a privacy request that arrives as an ordinary complaint.

Has your team ever rehearsed a breach notice to parents? Read about a breach response for a healthtech company, or reach TGC Legal.

Business Results

Outcomes are described qualitatively. Privacy compliance depends on facts and on how the Board reads the law, so attaching figures would be invention.

These observations relate to this platform and this programme. They are not a forecast for any other business.

Was the platform ready before the DPDP Rules took effect?

Yes. The consent flow, the notice, the analytics split and the grievance channel were live well ahead of the eighteen month commencement date.

That margin matters. It gives the team time to watch real behaviour, fix friction in the consent step and respond to any guidance the Board issues.

The platform can now show, document by document, how it meets Sections 5, 6, 8 and 9. That evidence is what a regulator or a school partner will ask to see.

Readiness is not a finish line. Rules can be clarified and products change. But the platform now has a structure for absorbing those changes.

How did parental consent affect signups?

Less than the founders feared. Some friction was expected and some appeared. Most of it came from parents who opened the link late at night on a small screen.

The team shortened the step after the first release. They also added a reminder for parents who began but didn't finish.

There was an unexpected benefit. Parents who completed the step became visible to the platform for the first time as account holders. Renewal conversations became easier, because the platform was speaking to the person who pays.

School partners responded well to the documented consent design.

What changed in marketing and product analytics?

Retargeting of child accounts stopped. Social audiences built from learner behaviour were deleted. Marketing moved towards parents and towards school partnerships.

Product analytics for child accounts became narrower and, oddly, more useful. Teams stopped chasing engagement signals and focused on whether students were actually learning.

Old data was cleaned up too. The support desk transcripts now follow a retention schedule. Sales spreadsheets moved into a controlled system.

Each of these changes reduced what could go wrong in a breach. Data that no longer exists cannot leak.

What risks were reduced?

The obvious one was regulatory. The platform no longer relies on a student's tick box for consent, and it no longer profiles children for advertising.

Commercial risk fell as well. School partners can now be given a clear answer on data handling, which removes a recurring obstacle in procurement.

Reputational risk is harder to see but just as real. A breach involving children's data reaches parents' groups within hours. The drill means the team will respond in an organised way.

None of this guarantees an outcome. It means the platform has done what the law asks and can show it.

Is your edtech ready for the May 2027 commencement? Explore our privacy service, or speak with TGC Legal.

Lessons Learned

One lesson changed how we open every privacy file. The rest confirmed that children's data is a product question first.

What surprised the team most?

The age definition. Founders and product teams routinely assume that older teenagers can consent for themselves. Under the Act they can't.

Once the team accepted that, the rest of the programme followed logically. Every learner account needed a parent behind it.

The second surprise was the analytics suite. Default settings had collected far more than anyone had chosen to collect. Nobody had decided to profile children. The tool simply did it.

We now ask for the analytics configuration in the first week of any privacy engagement. It usually tells us more than the privacy policy does.

What worked better than expected?

Writing the notice from the data register. Because the register was accurate, the notice was accurate, and the parent version was easy to read.

Engaging engineering early also paid off. Developers raised practical questions that improved the consent design. One suggested reusing verified parent details already held from payment, which fits Rule 10's first route.

The tracking position paper helped too. It gave marketing a clear rule, so debates about individual campaigns stopped.

Clients tend to accept a firm line more easily when it comes with a written reason.

What was hardest during implementation?

Reconsent for existing accounts. Parents don't respond to links on schedule, and students forget to send them.

We had to balance the duty to obtain parental consent against the risk of locking students out mid term. The restricted mode solved most of that. Students kept their progress, and full features returned once a parent completed the step.

Vendor negotiation was the other difficulty. Large vendors rarely change standard terms for a small client. Configuration and documentation had to fill the gap.

Both problems needed patience more than drafting.

What would we recommend to another edtech?

Count your child users honestly. If most are under eighteen, design for parental consent from signup, not as an add on.

Turn off advertising identifiers and retargeting for child accounts now. Section 9(3) is clear on targeted advertising, even if tracking is harder to define.

Don't build your plan on the educational institution exemption. It is narrow, and your status under it may be uncertain.

Finally, rehearse a breach. Rule 7 gives seventy two hours for a detailed report to the Board. That clock feels very short when nobody knows who holds the user list.

Want a second look at your consent flow before the next release? Read more on data protection agreements with vendors, or get in touch with TGC Legal.

Frequently Asked Questions

Who is a child under the DPDP Act 2023?

Section 2(f) defines a child as an individual who has not completed eighteen years of age. There is no separate category for older teenagers. So a seventeen year old student is treated the same as a ten year old, and the Data Fiduciary needs verifiable consent of the parent before processing that student's personal data.

What is verifiable parental consent under the DPDP Rules?

Rule 10 of the DPDP Rules 2025 requires the platform to obtain the parent's consent before processing a child's data. It must also check that the person consenting is an identifiable adult. It can use reliable identity and age details it already holds, or details provided voluntarily, including through a virtual token from an authorised entity or a Digital Locker service provider.

Can an edtech app show targeted ads to students?

Not to children. Section 9(3) of the Act says a Data Fiduciary shall not undertake targeted advertising directed at children. Because a child means anyone under eighteen, most school learners are covered. Advertising aimed at parents, who are adults, is a separate matter governed by the ordinary consent rules.

Does the DPDP Act ban learning analytics for children?

Section 9(3) bars tracking and behavioural monitoring of children, but the Act does not define those phrases. Recording a test score to show progress is different from building profiles to predict and influence behaviour. A cautious reading keeps what is needed to deliver the lesson and removes profiling that goes beyond it.

Are edtech platforms exempt as educational institutions?

Possibly not. Part A of the Fourth Schedule to the DPDP Rules 2025 relaxes Sections 9(1) and 9(3) for an educational institution, but only for tracking and behavioural monitoring for its educational activities or for the safety of enrolled children. Whether a subscription app is an educational institution is untested, so relying on it carries risk.

When do the DPDP Rules 2025 take effect?

The Rules were notified in November 2025. Rules 1, 2 and 17 to 21 took effect on publication. Rule 4 on Consent Managers takes effect one year later. Rules 3, 5 to 16, 22 and 23, which cover notice, security, breach intimation, children's consent and rights, take effect eighteen months after publication.

How quickly must a personal data breach be reported?

Rule 7 requires the Data Fiduciary to inform each affected Data Principal without delay. The Board must receive an initial intimation without delay, followed by a detailed report within seventy two hours of becoming aware of the breach. The Board may allow a longer period if a written request is made.

What must a DPDP consent notice include?

Section 5 and Rule 3 require a standalone notice in clear and plain language. It must give an itemised description of the personal data, the specific purposes, and how to withdraw consent, exercise rights and complain to the Board. Section 5(3) also requires an option to read it in English or an Eighth Schedule language.

Do vendor contracts need to change under the DPDP Act?

Often, yes. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract, and Section 8(1) keeps the Fiduciary responsible for the Processor's processing. Rule 6 expects the contract to provide for reasonable security safeguards. Breach notice, deletion and permitted use are sensible additions.

How long can a platform take to answer a privacy grievance?

Rule 14(3) requires the Data Fiduciary to publish its response period for grievances, which cannot exceed ninety days. Section 8(10) requires an effective grievance mechanism. In practice, a much shorter internal target makes sense, especially where parents are raising concerns about their children's data.

Conclusion

An edtech that serves school students needs a data privacy advisory service long before the DPDP Rules take full effect. Almost every learner is a child under Section 2(f) of the Act. That single fact brings in Section 9: verifiable parental consent, and no tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 explains how to verify a parent. Rule 7 sets the breach intimation steps, including a detailed report to the Board within seventy two hours. Most of these rules take effect eighteen months after the November 2025 notification. For this Kochi platform, the work began with a data register and ended with a rehearsed breach plan. In between came a parent notice in two languages, a consent flow that verifies an adult, an analytics split for child accounts, reviewed vendor contracts and a grievance channel. The platform was ready ahead of the deadlines, and it can now show how. If your learners are mostly under eighteen, start with the data map and the analytics settings. Then read our explainer on DPDP compliance and write to TGC Legal for a readiness review.

Sources

This case study is issued in public interest and for general information only. Client identity and commercially sensitive details are withheld. Outcomes are described qualitatively, without figures, because legal results depend on the evidence on record and on the discretion of the deciding authority. Nothing here is legal advice on any specific matter.