DPDP compliance for schools, coaching institutes and kids’ EdTech.
The Digital Personal Data Protection Act’s full obligations apply from 13 May 2027, about seven months away. If you process data about learners under 18, you need consent flows, notices, retention rules and a breach process in place before then.
School Starter ₹49,000Institution ₹1,50,000EdTech Platform from ₹3,00,000
Not legal advice. This page and the packages below describe an implementation project. Our compliance materials are reviewed by a partner law firm for accuracy against the DPDP Rules, but they are not a substitute for advice from your own lawyer about your organisation.
India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified 13 November 2025) require organisations that process personal data to give clear notices, collect valid consent, protect and delete data on time, and report breaches. Anyone under 18 is a “child”, and their data generally needs verifiable parental consent. Full obligations apply from 13 May 2027. UTSL implements this for education organisations, with packages from ₹49,000 plus GST.
What’s changing, and by when
- August 2023: the Digital Personal Data Protection Act, 2023 is passed.
- 13 November 2025: the DPDP Rules, 2025 are notified, setting out how the Act is enforced, and the Data Protection Board is established.
- 13 May 2027: the substantive obligations apply, including notices, consent, children’s data, security safeguards, retention and breach notification.
What the DPDP Act requires in practice
Notice and consent
Before collecting personal data, you tell people clearly what you collect and why, and get consent that is specific and easy to withdraw. Withdrawing must be as easy as giving it.
Children’s data
For anyone under 18, verifiable consent from a parent or lawful guardian is generally required before processing, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited. The Rules describe how a parent’s identity and age can be verified.
Educational institutions: what the exemptions do and don’t cover
The Rules exempt educational institutions from some children’s-data requirements, but only for specific purposes, such as educational activities and the safety of students. Processing beyond those purposes, like marketing or analytics, and most commercial EdTech products, are not covered by that exemption. Working out which of your data flows fall inside it is one of the first things we do.
Security, retention and breaches
You must protect personal data with reasonable security safeguards, erase it when it is no longer needed for its purpose, and notify the Data Protection Board and affected people if there is a breach.
Rights of learners and parents
People can ask what data you hold, ask for corrections or erasure, and raise grievances. You need a working process and a named contact to handle these requests.
What our compliance kit delivers
- Data map. Every system that touches learner data, including the LMS, admissions, fees, apps and spreadsheets, what it holds and why.
- Gap assessment against the Act and Rules, including which flows fall inside the educational-institution exemption.
- Notices and consent flows for learners and parents, including verifiable parental consent where it is needed.
- Retention and deletion schedule configured in your systems, not just written in a policy.
- Breach response process with roles, templates and timelines.
- Rights-request process and grievance contact.
- Staff briefing so teachers and administrators know what changes for them.
For schools running Moodle, we also configure Moodle’s privacy tools: policies and consent, data requests and data retention settings.
Packages (India, INR + GST)
| Package | Price | Fits |
|---|---|---|
| DPDP School Starter | ₹49,000 | A single school or coaching institute getting the essentials in place. |
| DPDP Institution | ₹1,50,000 | Larger institutions with multiple systems touching student data. |
| DPDP EdTech Platform | from ₹3,00,000 | Kids’-EdTech apps and platforms with product-level consent flows to build. |
| DPDP Care | ₹6,000–15,000/mo | Ongoing monitoring and updates as guidance evolves. |
| Moodle upgrade (India) | ₹60,000–2,00,000 | Same fixed-price approach as our USD upgrade tiers. |
Plus GST. The exact package depends on your systems and user base, so ask for a scoping conversation.
DPDP compliance FAQ
What is the DPDP compliance deadline?
The DPDP Rules were notified on 13 November 2025, and the substantive obligations apply from 13 May 2027. Under the Act, anyone under 18 is a child, and processing their data generally needs verifiable parental consent.
Are schools exempt from the DPDP Act?
No. Educational institutions are exempt from some children’s-data requirements, such as verifiable parental consent and the tracking ban, but only for specified purposes like educational activities and student safety. All other DPDP obligations still apply, and processing outside those purposes is not exempt.
What are the penalties under the DPDP Act?
Penalties are set per contravention and can reach ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for breaching the additional obligations for children’s data.
Does the DPDP Act apply to EdTech apps?
Yes. EdTech companies that process personal data of learners in India are Data Fiduciaries under the Act. Where users are under 18, they need verifiable parental consent and must avoid tracking and targeted advertising aimed at children.
Is our data safe with you? Are you DPDP or GDPR compliant?
For technical Moodle engagements, UTSL acts as a processor for the platform, not a data controller. Your organisation remains responsible for the data on the site. This DPDP kit is a separate, India-specific service for organisations that need to meet the Act themselves.
Is this legal advice?
No. This page and the compliance kit describe a practical implementation project, reviewed by a partner law firm for accuracy against the DPDP Rules. It is not a substitute for advice from your own lawyer on your situation.
Seven months goes quickly.
Start scoping now so consent flows and policy work aren’t rushed in early 2027.