DPDP compliance for schools, coaching institutes and kids' EdTech.
Full compliance is required by 13 May 2027. If your platform has users under 18, you need verifiable parental consent — and a plan for the two years between now and then.
Not legal advice. This page and the packages below describe an implementation project. Our compliance materials are reviewed by a partner law firm for accuracy against the DPDP Rules, but they are not a substitute for advice from your own lawyer about your specific organisation.
What's changing, and by when
- 13 Nov 2025 — The DPDP Rules were notified, setting out how the Digital Personal Data Protection Act, 2023 will actually be enforced.
- Now – 13 May 2027 — The compliance window: consent flows, data mapping, retention and breach-notification processes need to be in place.
- 13 May 2027 — Full compliance is required. Anyone under 18 counts as a “child” and needs verifiable parental consent. Penalties for non-compliance can reach ₹250 crore.
Packages (India, INR + GST)
| Package | Price | Fits |
|---|---|---|
| DPDP School Starter | ₹49,000 | A single school or coaching institute getting the essentials in place. |
| DPDP Institution | ₹1,50,000 | Larger institutions with multiple systems touching student data. |
| DPDP EdTech Platform | from ₹3,00,000 | Kids'-EdTech apps and platforms with product-level consent flows to build. |
| DPDP Care | ₹6,000–15,000/mo | Ongoing monitoring and updates as guidance evolves. |
Plus GST. Exact package depends on your systems and user base — ask for a scoping conversation.
Frequently asked questions
Is our data safe with you / are you DPDP or GDPR compliant?
For technical Moodle engagements, UTSL acts as a processor of the platform, not a data controller — your organisation remains responsible for the data on the site. This DPDP compliance kit is a separate, India-specific offer for schools, coaching institutes and kids' EdTech apps that need to meet the DPDP Act themselves.
Is this legal advice?
No. This page and the compliance kit describe a practical implementation project, reviewed by a partner law firm for accuracy against the DPDP Rules. It is not a substitute for advice from your own lawyer on your specific situation.
What's the deadline?
The DPDP Rules were notified on 13 November 2025. Full compliance is required by 13 May 2027. Under the Act, anyone under 18 is a “child” and needs verifiable parental consent before their data is processed.
Two years sounds like a long time — until it isn't.
Get a scoping conversation now so the consent-flow and policy work isn't rushed in early 2027.