evidoria

← Back to browse

Good practice Imported

India's DPDP Rules 2025 — National Child Data Protection Framework for Schools and EdTech

India · New Delhi · See the India profile · See the New Delhi profile

Evidence: Descriptive / self-reported Top 56% 47/100 · Ask Evidence Copilot about this practice

India's Digital Personal Data Protection Rules 2025, gazetted 13 Nov 2025, impose verifiable parental consent, ban behavioural tracking and targeted ads to under-18s, and set fines up to ₹200 crore — reshaping how EdTech platforms and schools handle student data.

200 ₹ crore
Maximum penalty for children's-data violations
~250 million
School-age population covered
18 months
Runway before most obligations take effect (to 13 May 2027)

Details

Maturity
Scaling
Promoter
Ministry of Electronics and Information Technology (MeitY) / Data Protection Board of India
Period
2025–present
Keywords
data protection, children's privacy, EdTech regulation, government policy

Context

India's Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection (DPDP) Rules 2025 in the Gazette of India on 13 November 2025, operationalising the Digital Personal Data Protection Act 2023 after a draft consultation released in January 2025.

Objectives

The Rules aim to protect the personal data of India's roughly 250 million school-age population by requiring verifiable parental consent for users under 18 and prohibiting behavioural tracking and targeted advertising directed at children, provisions that apply directly to EdTech apps, online assessment tools and school-facing AI platforms.

Activities

Rule 10 requires data fiduciaries to obtain verifiable parental consent, including via Aadhaar-linked DigiLocker tokens with audit trails; Rule 11 adds lawful-guardianship verification for children with disabilities; Rule 12 carves out a narrow exemption letting schools process certain data without full parental consent when strictly necessary for health, safety or essential educational services.

Results

Most obligations take effect only after an 18-month runway, with a compliance deadline of 13 May 2027, so no enforcement track record exists at the time of writing; the evidenced element to date is the statutory mechanism itself -- defined penalties of up to ₹200 crore for children's-data violations and a dedicated Data Protection Board with investigative and platform-blocking powers.

Conclusions

Because enforcement has not yet begun, the Rules cannot yet be assessed for real-world compliance or impact on EdTech data practices -- only for the strength of the legal mechanism they establish.

Implementation
Indicative cost
Medium (€50k–€500k) — No specific budget figures were found; compliance will require EdTech platforms and schools to build consent-verification, audit-trail and data-handling systems ahead of the 13 May 2027 deadline.
Time to results
Long (> 3 years) — Gazetted 13 November 2025 following a January 2025 draft consultation; most obligations phase in over an 18-month runway to a 13 May 2027 compliance deadline.
Staffing & skills
Ministry of Electronics and Information Technology (MeitY), Data Protection Board of India

Conditions for success

  • Aadhaar-linked DigiLocker infrastructure available for verifiable parental consent tokens
  • EdTech platforms and schools building consent-verification and audit-trail systems ahead of the May 2027 deadline
  • A functioning Data Protection Board with investigative and platform-blocking powers to enforce the Rules

Common failure modes

  • An 18-month compliance runway means no enforcement track record exists yet to confirm the Rules change actual data practices
  • Reliance on Aadhaar/DigiLocker verification could exclude families without that infrastructure

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful