EdTech is the sector most exposed to the DPDPA’s children’s data provisions. AMLEGALS builds the verifiable parental consent mechanism, the purpose-limitation architecture and the processor governance that let platforms operate lawfully under Section 9.
The DPDPA defines a child as anyone under eighteen — not fourteen, not sixteen, but eighteen. This means that virtually every EdTech platform in India processes children’s data. Section 9 imposes three obligations that do not apply to adult data: verifiable parental consent (not self-declared age), prohibition on behavioural monitoring directed at children and prohibition on targeted advertising directed at children. The penalty ceiling for Section 9 non-compliance is ₹200 crore under the Schedule.
AMLEGALS advises EdTech platforms, K-12 online schools, test-prep companies, university LMS providers and coding academies on building DPDPA-compliant architectures. The practice covers age-verification and parental-consent mechanisms under Rule 10, purpose-limitation for learning analytics and proctoring data, teacher and staff data processing, payment data segregation, cross-border transfers to international content and assessment providers, and scalable rights-fulfilment systems for students and parents.
Implementing Rule 10 compliant age-gating and verifiable parental consent mechanisms in the registration flow.
Assessing whether learning analytics and adaptive algorithms constitute behavioural monitoring under Section 9 and structuring compliant alternatives.
Building the notice, consent and retention framework for webcam, screen-recording and keystroke data collected during assessments.
Auditing Section 8(2) contracts with LMS providers, cloud platforms and international content partners and assessing Section 16 compliance.
Designing automated systems for access, correction, erasure and grievance redressal under Sections 11–14, including parental access for children’s data.
Establishing the Section 8(6) and Rule 7 breach response workflow and preparing the evidence file for potential Board inquiries.
EdTech platforms process personal data of children (anyone under eighteen under the DPDPA). Section 9 imposes heightened obligations: verifiable parental consent before any processing, prohibition on behavioural monitoring and targeted advertising directed at children, and a prohibition on processing likely to cause detrimental effect. The penalty for non-compliance with Section 9 obligations is up to ₹200 crore under the Schedule.
Rule 10 of the DPDP Rules 2025 prescribes the mechanism for obtaining verifiable parental consent. The consent must be obtained from a parent or lawful guardian whose identity is verified through a reliable method. A simple tick-box or self-declaration of age is insufficient. The Rules contemplate verification through government-issued identity credentials of the parent, linked to the child’s account.
Section 9 operates as a special provision that overrides the general legitimate-use provisions of Section 7 when the Data Principal is a child. Even where processing is necessary for a contract (subscription, course enrolment), verifiable parental consent is required. The only exception is that the Central Government may exempt certain Data Fiduciaries or classes of processing from Section 9 obligations — no such exemption has been notified as of October 2026.
Learning analytics (time spent, quiz scores, engagement patterns) and proctoring data (webcam feeds, screen recordings, keystroke dynamics) are personal data. Their processing requires specific notice under Section 5 and specific consent under Section 6. For children, the behavioural monitoring prohibition in Section 9 means that adaptive learning algorithms that track and profile a child’s behaviour must be assessed for whether they constitute behavioural monitoring.
EdTech platforms that use international content providers, cloud-hosted LMS platforms or overseas assessment engines transfer personal data outside India. Section 16 restricts such transfers to notified countries or territories. Until the Central Government publishes the notification, platforms must assess whether their data flows comply with any requirements specified by the Central Government under Rule 15 and with sector-specific requirements.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing.
Share the platform profile for a confidential assessment of DPDPA compliance requirements.