DPDPA Compliance for Edtech & Coaching Institutes in Bangalore

Edtech and coaching businesses handle student data, and frequently the data of minors. The DPDP Act imposes special, stricter duties for children's personal data.

Bangalore context: India's startup and SaaS capital — product analytics and sub-processor sprawl are the dominant compliance gaps. The obligations below apply to edtech platforms and coaching institutes operating in Bangalore, Karnataka — there is no local exemption and no turnover threshold under the DPDP Act.

DPDPA applies. Processing children's data triggers verifiable parental consent and a ban on tracking, behavioural monitoring and targeted advertising to children.

• Student name, age, school
• Parent/guardian contact
• Academic performance & assessments
• Attendance and behavioural data
• Payment and admission records

• Targeted ads or retargeting to minors
• No verifiable parental consent
• Sharing student data with partners/agents
• Behavioural tracking of children

• Verifiable parental consent for under-18 data
• No tracking/behavioural monitoring/targeted ads to children
• Privacy notice for parents in plain language
• Processor contracts with ed-partners and tools
• Retention limited to the educational purpose

• Marketing pixels firing on student accounts
• Admission data reused for unrelated marketing
• No age-gating

• Add an age gate and parental-consent step
• Disable ad/retargeting pixels for student flows
• Publish a parent-facing privacy notice
• Document lawful basis for each data use

What counts as a child under DPDPA?

Anyone under 18. Processing their data needs verifiable consent from a parent or lawful guardian.

Can we run retargeting ads on our courses?

Not where they reach children. Behavioural tracking and targeted advertising to minors are prohibited.