Understanding India's DPDP Act: What Student Data Rights Now Mean

Table of Contents

• Introduction
• What Is the DPDP Act in Plain Terms
• Why Students Are Uniquely Affected
• Core Rights Students Now Hold
• How EdTech and Colleges Must Change
• What Students Can Do Practically
• Conclusion
• FAQ

Introduction

The Digital Personal Data Protection Act, 2023, passed by Parliament and now moving into enforcement phases, is the first comprehensive privacy law India has had for personal data. For students, who spend a large part of their academic life on EdTech platforms, college portals, scholarship applications, coaching apps, and online exam systems, this shift is more consequential than it sounds. Until recently, a student handing over an Aadhaar copy to a coaching centre or signing up for a learning app had almost no legal lever if that data was misused, leaked, or sold onwards.

The DPDP Act changes that ground reality. It defines who can collect student data, on what basis, and for how long. It also gives students (or their parents, in the case of minors) the right to know, correct, and erase what is held about them. For a generation that lives across logins, dashboards, and uploaded ID proofs, this is the first time the rules of the digital classroom are written down.

This guide unpacks the dpdp act for students in practical terms: what the law actually does, where the rights matter most in student life, and what to expect from institutions and EdTech platforms in 2026.

What Is the DPDP Act in Plain Terms

The DPDP Act, 2023, is India's first standalone law focused only on personal data. It applies to any entity (called a Data Fiduciary) that collects or processes digital personal data of people in India. Coaching institutes, universities, learning apps, scholarship portals, and even school ERP systems fall under this definition.

The Act is built on a simple principle: data can be collected only for a specific, lawful purpose, with the informed consent of the person it belongs to. Once that purpose is fulfilled, the data must be deleted. In practical terms, a coaching platform collecting documents for admission cannot continue holding them indefinitely without a valid reason. Consent must be free, specific, informed, and capable of being withdrawn, which means a long terms-and-conditions wall that a student blindly accepts to register for a mock test no longer qualifies as valid consent.

The Act also creates a new regulator, the Data Protection Board of India, which can investigate complaints and impose financial penalties on institutions that breach the rules. Penalties can run up to Rs 250 crore per instance under provisions notified by the Ministry of Electronics and IT.

Why Students Are Uniquely Affected

Students sit at the intersection of every category of sensitive data the law worries about: identity documents, academic records, biometric scans for proctored exams, behavioural data from learning apps, payment information, and in many cases, parental records too. A single coaching enrolment in India today can involve sharing Aadhaar, PAN of a parent, board marksheet, photograph, and bank details, often across two or three separate platforms.

The Act treats anyone under 18 as a child, and processing of a child's data requires verifiable parental consent. It also bars Data Fiduciaries from tracking, behaviourally monitoring, or running targeted advertising on children. For school students using app-based learning, this is a significant shift. A platform that previously personalised content using engagement signals from a 14-year-old must now restructure how it handles that data.

For college students above 18, the consent burden moves to the student directly. But the protections remain strong: every learning app, placement portal, or hostel management system must justify why each field is being collected.

Core Rights Students Now Hold

The Act grants every student (as a Data Principal) a set of rights that did not exist in enforceable form before. Understanding these rights is the practical core of the dpdp act for students.

These rights are not theoretical. Once the Data Protection Board becomes fully operational, students can file complaints directly if an institution refuses to honour a request within the stipulated time.

How EdTech and Colleges Must Change

For institutions, the operational changes are substantial. EdTech platforms have to redesign signup flows so consent is granular: a student should be able to register for a course without also agreeing to marketing emails or third-party sharing. Privacy notices must be plain-language and available in regional languages, a requirement that matters in a country where a large share of learners study in their mother tongue.

Colleges and universities, which have historically held student records indefinitely, now need defined retention policies. A scholarship application processed in first year cannot quietly remain on a server through final year. Significant Data Fiduciaries, a category likely to include large EdTech platforms and major universities, will additionally need to appoint a Data Protection Officer and conduct periodic audits.

Cross-border transfer of student data also gets tighter. Many learning platforms host data on servers outside India; the Act allows the central government to restrict transfers to specific countries, which can affect how international course providers operate locally. For students, the immediate visible change will be cleaner consent screens, clearer privacy notices, and the option to download or delete one's account data.

What Students Can Do Practically

Knowing the law matters less than using it. A few practical habits help students convert these rights into everyday protection.

• Read what you are consenting to before registering for any coaching app, mock test platform, or scholarship portal. Look for whether marketing consent is bundled with service consent.
• Keep a personal log of where you have uploaded ID proofs (Aadhaar, marksheets, photographs). If you stop using a platform, send a written deletion request.
• Use the platform's grievance officer contact (now mandatory) for any data concern, before escalating to the Data Protection Board.
• For school students, parents should be the ones giving consent, and should review what behavioural data the app collects.
• Treat consent withdrawal as a routine action, not an extreme step. Once a course is over, your data should not still be powering recommendation engines.

Building digital hygiene early is more useful than reacting to a breach later. Some of these habits overlap with broader online safety practices, which the team has covered in cybersecurity tips for students and cybercrime awareness for students.

Conclusion

The dpdp act for students is not a checklist of compliance for institutions alone; it reshapes the relationship between learners and the digital systems they depend on. For the first time, a student in India can ask a coaching platform, a university, or a scholarship portal a direct question about their data and expect a legally backed answer. That is a meaningful redrawing of power in a country where almost every educational interaction now begins with an upload.

The deeper shift, however, is cultural. Until students start exercising these rights routinely, institutions will treat the law as paperwork. The early years of any privacy regime are decided by how informed its users are. For this generation of learners, the homework is not just academic anymore.

FAQ

Does the DPDP Act apply to school students under 18?

Yes, but with stronger safeguards. The Act classifies anyone under 18 as a child, and processing their personal data requires verifiable parental or guardian consent. Platforms are also barred from behaviourally tracking children or running targeted ads at them.

Can a college refuse my request to delete my data after I graduate?

Only if the data is required for a legitimate purpose recognised under law, such as maintaining academic records that the institution is statutorily obliged to preserve. For everything else (marketing lists, optional surveys, app analytics), you can request deletion once the purpose is fulfilled.

What can I do if an EdTech app shares my data without permission?

First, reach out to the platform's grievance officer, whose contact details must be displayed on the site or app. If the response is unsatisfactory or absent, you can escalate the complaint to the Data Protection Board of India, which has the authority to investigate and impose penalties.

Does withdrawing consent mean I lose access to a learning platform?

It can, if the data was essential for the service. Withdrawing consent for processing related to the core service (like course access) typically ends that service. But you can withdraw consent for optional uses, such as marketing emails or third-party sharing, without losing your account.

Are private tuition centres also covered under the DPDP Act?

Yes. Any entity that collects digital personal data of individuals in India, regardless of size, is a Data Fiduciary under the Act. A neighbourhood coaching centre collecting Aadhaar copies and parent details digitally is bound by the same principles of consent, purpose limitation, and retention as a large EdTech platform.