Student Data and Parent Consent Under DPDP: A Checklist for Schools and Coaching Centres
Published: 10/9/2026
Category: Education
Most students are under 18, and the DPDP law treats children's data with extra care, including verifiable parental consent. A checklist for schools, coaching centres and academies.
Schools, coaching centres and academies collect data about children every day: names, photos, marks, attendance, health notes and parents' contacts. Under the DPDP Act, a child is anyone under 18, and processing a child's personal data generally needs verifiable consent from a parent or guardian, with extra restrictions on tracking and targeted advertising. The Rules include some exemptions for educational institutions for specific purposes, so check what applies to you.
Where student data lives
- Admission forms and ID copies
- Attendance and marks registers or software
- Class WhatsApp groups
- Photos and videos of events
- Fee records with parents' bank or UPI details
- Transport lists with addresses
The checklist
- Update the admission form. Explain in plain language what data you collect, why, who sees it and how parents can contact you. Include a parent or guardian consent section.
- Separate essential from optional uses. Attendance and fees are part of education; photos on social media and marketing for other courses are optional and need separate consent.
- Photos and videos: ask parents before posting children's photos publicly, and respect a "no".
- Class WhatsApp groups: use communities or broadcast-style groups where parents cannot see each other's numbers if possible, and keep groups for school matters.
- Limit staff access. Teachers see their classes; accounts staff see fees; only the principal or owner exports full lists.
- No tracking or targeted ads using children's data. Do not use student data to target advertising.
- Retention: keep academic records as required, and delete data you no longer need, such as enquiry data from families who did not join.
- Breach plan: decide who acts if a register, phone or account is lost or hacked.
Coaching centres and academies
Coaching centres often reuse student and parent numbers to promote new batches. Under DPDP, that kind of marketing needs consent. Ask at admission, with a separate tick box, and offer an easy way to opt out.
Where BizFlow fits
BizFlow's EduFlow keeps admissions, attendance, fees and parent communication in one system with role-based staff access and consent records, instead of spreadsheets and personal phones. See also school fee management.
General information, not legal advice.
Frequently asked questions
Q: Do schools need parent consent under the DPDP Act?
A: Processing children's personal data generally requires verifiable parental consent, with some exemptions for educational institutions for specific purposes. Check the notified Rules for what applies to you.
Q: Can coaching centres send course offers to past students?
A: Only with consent. Ask clearly at admission and make it easy to opt out.
Sources
Home | Blog