InfraVeritas360DPDPiqDPDP Insights › All sectors › Education
Sector
DPDP for education
Schools, colleges and ed-tech platforms hold children's data at scale. Rule 12 and the Fourth Schedule exempt educational institutions from some children's-data limits for educational activities and safety, but not for marketing or unrelated tracking.
Open the interactive tool for this sectorThis sector is in its core view. The law, guides and seat notes apply in full; the sector pack with role briefs and worked examples is being written.
Types of organisation
- SchoolsMost students are under 18, so parent consent and no-tracking rules matter, subject to the Fourth Schedule exemptions.
- Universities and collegesMany students are adults, but some are under 18 at entry.
- Ed-tech and coachingApps track learning behaviour, which the Act limits for children.
Whose data you hold
- Students (mostly children)
- Parents and guardians
- Teachers and staff
- Applicants
- Alumni
Rules that sit alongside DPDP
| Rule | What it says | What it means alongside DPDP | Source |
|---|---|---|---|
| CERT-In Directions, 2022 | Report specified cyber incidents within six hours; keep ICT logs 180 days within India. | Applies alongside the DPDP breach steps. | CERT-In |
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.