India's DPDP Rules 2025 — National Child Data Protection Framework for Schools and EdTech

The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules 2025 in the Gazette of India on 13 November 2025, operationalising the Digital Personal Data Protection Act 2023 after a draft consultation released on 3 January 2025.

Rule 10 requires data fiduciaries to obtain “verifiable parental consent” for any user under 18, including via Aadhaar-linked DigiLocker tokens with audit trails; Rule 11 sets special provisions for children with disabilities requiring lawful-guardianship verification; the Rules prohibit behavioural tracking, monitoring and targeted advertising directed at children — provisions that apply squarely to EdTech apps, online assessment tools and school-facing AI platforms serving India's roughly 250 million school-age population. Rule 12 carves out a narrow exemption letting schools process certain data without full parental consent when strictly necessary for health, safety or essential educational services.

Most obligations take effect only after an 18-month runway (compliance deadline 13 May 2027), so at the time of writing there is no enforcement track record yet. The evidenced strength here is the statutory mechanism itself — defined penalties up to ₹200 crore for children's-data violations and a dedicated Data Protection Board with investigative and platform-blocking powers (Section 37) — not yet a measured outcome.

Read the full analysis: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf