DPDP for edtech (India): schools, parents & learners playbook
- Connect day-to-day workflows to what you collect, disclose, and retain—on real user journeys.
- Review forms, integrations, and vendor access on a real journey.
- Document decisions so sales and product do not contradict support.
- When stakes are high, verify wording against official resources.
- Use the compliance portal to pick the next operational drill.
Edtech sits between learners (often minors), parents, and institutions that think they own roster files. DPDP implementation requires crisp role clarity—see roles & RACI—and operational discipline on bulk uploads, proctoring, and CS exports. Use this with children’s data rules and the checklist.
30-day playbook
- Week 1 — Contract truth: Map MSAs with schools vs your consumer T&Cs; list who can export rosters.
- Week 2 — Minors & guardians: Parent controls vs learner accounts; tie to onboarding best practices.
- Week 3 — Assessment & proctoring: Video, screen capture, item banks—retention and access.
- Week 4 — Offboarding: Graduation, school churn, sibling accounts—deletion and export paths.
Lifecycle
- Acquisition: Trials, webinars, free worksheets—PII before institutional contracts.
- Enrollment: Roster CSV uploads, SSO, classroom codes.
- Instruction: Assignments, forums, tutoring chat, proctoring events.
- Transitions: Account merges, alumni, data portability asks.
Systems grid
| Layer | Govern | Questions |
|---|---|---|
| LMS / content | Video DRM, offline tablets | Shared devices at home—what persists? |
| Assessment | Proctoring, plagiarism | Biometric-ish signals; retention of recordings |
| CRM / success | Parent journeys, upsell | Separate from academic records? |
| Safety | Moderation, counselor notes | High-sensitivity access roles; audit logs |
Disclosure: No pay-to-rank tools; categories for planning. See editorial policy.
Consent & notice
If your users are under 18 (the statutory definition of "child," Section 2(f)), Section 9(1) requires verifiable parental consent, and Section 9(3) bars tracking, behavioural monitoring, and targeted advertising directed at them — full stop, no general edtech carve-out from that sub-clause. The one relevant exemption: Rule 12 and Part A of the Fourth Schedule let an educational institution track and behaviourally monitor students without fresh parental consent, but only for the institution's own educational activities or student safety — not for gamification, engagement scoring, or third-party ad personalization layered on top.
- Guardian vs learner actions: Document who can flip which settings.
- School substitution: Your subprocessors must still appear where users expect.
- Gamification: Push content on shared family devices.
Failure modes
- Cohort leakage in “helpful” exports.
- Teacher-as-admin seeing wrong classes.
- Marketing samples with certificates or leaderboards.
Illustrative hypothetical (fiction, not factual): “BrightBridge Tutors” receives CSVs with DOB and parent ID fragments for billing. A center employee copies the sheet to a laptop. A parent requests access; your cloud map is complete but shadow copies are not. Fix: export controls, expiring links, contractual teeth—plus fiduciary vs processor clarity for center-side handling.