Coaching institutes and schools: parental consent for students' data

कोचिंग और स्कूल: छात्रों के डेटा के लिए माता-पिता की सहमति

20 October 2026 · 4 min read · Satya Shield

Most students at a coaching institute or school are under 18. Under the Digital Personal Data Protection Act, 2023, that makes them children, and the law treats their personal data with extra care. If you run a coaching centre, tuition classes, a school or hobby classes, this is the part of the Act that affects you most.

What the Act says about children

Section 9 of the Act sets three rules for any business handling a child's personal data:

1. Verifiable parental consent: before using a child's data, you need consent from a parent or lawful guardian, obtained in a way you can verify.
2. No harm: you must not process a child's data in a way likely to harm the child's well-being.
3. No tracking or targeted ads: you must not track or monitor children's behaviour, or show them targeted advertising.

The DPDP Rules, 2025 explain how to verify that the person giving consent is really an adult parent or guardian. They also include some exemptions, for example for educational institutions, limited to what is needed for educational activities and the child's safety. These exemptions are narrow, so don't assume they cover everything you do.

Where coaching centres usually go wrong

Admission forms

Most forms collect the student's details and a parent's phone number, but never actually ask the parent for consent. Fix this with a parent consent section: tick boxes for each purpose, the parent's signature, and confirmation that they are 18 or older.

Verifying the parent

You need a reasonable way to check the parent is who they say they are. Common approaches: details you already hold for that parent, an original ID seen in person (note only the type and last four digits, never photocopy the full Aadhaar), or a government-authorised token such as DigiLocker.

Photos and videos on social media

Posting toppers' photos and class videos on Instagram, YouTube or posters is a separate purpose. It needs its own optional consent from the parent, and the parent must be able to withdraw it, after which you take the posts down.

WhatsApp groups

Batch groups often show every parent's and student's number to everyone else. Prefer broadcast lists or a WhatsApp community where numbers aren't visible, and never add parents to groups they didn't agree to.

Enquiry data

Leads from students who didn't join shouldn't be kept forever. Set a period (for example one admission season) and delete them after that.

A simple checklist for this admission season

• ☐ Admission form has a parent consent section with separate, unticked boxes
• ☐ Optional consent for photos and videos, kept separate
• ☐ A way to verify the parent, without storing full ID numbers
• ☐ A privacy notice for parents in English and Hindi
• ☐ Batch WhatsApp groups that don't expose everyone's numbers
• ☐ No targeted ads aimed at students
• ☐ A grievance contact parents can write to

Want to know where your institute stands? Our free DPDP risk check takes 3 minutes and works in Hindi too.

This article is general information to help small businesses understand the law. It is not legal advice. Official texts: DPDP Act, 2023 and DPDP Rules, 2025.