Sec. 9
Verifiable guardian consent for under-18s
School and undergraduate intake routinely involves minors. Guardian consent must be verifiable, and tracking or behavioural advertising directed at those students is prohibited outright.
DPDP by industry
DPDP for universities and education providers
Education providers process the data of minors at scale, retain it for decades, and share it with examination bodies, placement partners and edtech platforms — the combination the Act treats most cautiously.
- Deadline
- 13 May 2027
- Pressure points
- 3 identified
- Controls
- 4 products
- Max penalty
- ₹250 Cr, per instance
Already regulated by
- UGC
- AICTE
- CBSE / state boards
- MeitY
DPDP sits alongside these rather than replacing them. Where a sectoral rule requires retention and the Act requires erasure, both are satisfiable — but only where the basis is recorded per attribute.
Where the pressure lands
What DPDP actually changes for education
The Act applies uniformly. The obligations that bite first do not — these are the ones this sector fails on.
Sec. 6(1), 8(7)
Alumni retention and purpose drift
Student records are retained indefinitely and re-used for fundraising and marketing — purposes the original consent did not cover. Purpose drift is the most common defect in this sector.
Sec. 8(1)–(2)
Edtech and proctoring processors
LMS, proctoring and analytics vendors process student data on the institution's behalf, and the institution carries the liability for them.
What closes them
The controls, in the order they land
Discovery first, because every other obligation is undeliverable without a catalogue. Everything after that consumes what it built.
- 01
Consent Management
Capture valid consent per purpose, give people self-service control, and make it the authoritative signal everywhere.
Sec. 5, 6, 9
- 02
DSAR Management
Receive, verify, fulfil and audit every access, correction, erasure and grievance request inside the statutory clock.
Sec. 11–14
- 03
Intelligent Data Mapper
Replace stale inventories with a live, identity-resolved map of every place personal data actually lives.
Sec. 8(3), 8(7)
- 04
Privacy Program Governance
Run the whole privacy programme from one control plane, so the next regulation lands as configuration.
Sec. 4, 7, 10, 16
Sequence
A readiness plan that buys down the biggest exposure first
The same four phases apply in every sector; what changes is which systems go first.
Phase 1
Weeks 1–6
See the estate
- Deploy Discovery across priority systems
- Build the identity-resolved catalogue
- Reconcile collected data against notice
Phase 2
Weeks 4–12
Stop the bleeding
- Mask non-production and analytics estates
- Deploy breach detection and playbooks
- Wire intimation to the catalogue
Phase 3
Weeks 8–18
Fix the basis
- Roll out purpose-level consent and notice
- Enforce withdrawal parity and cessation
- Turn on children's age-band gating
Phase 4
Weeks 14–26
Prove it
- Automate DSAR intake and fulfilment
- Run DPIA cadence for SDF duties
- Open the auditor workspace
Also defending education?
Remote proctoring and admissions verification backed by liveness detection and behavioural analysis, protecting exam integrity at scale.
DPDP for other sectors
Find the gaps in your education programme.
A readiness walkthrough maps what you already run onto the eighteen obligations, and names what is missing with the exposure attached.