What the DPDP Act and the Fourth Schedule let schools and edtech do with children's data.
Educational only · not legal adviceLast updated: 5 October 2026Written and edited by Sandesh Kokate
Short answer
A child is anyone under 18. You need verifiable consent from a parent or guardian (Section 9(1)). You must not track or monitor children's behaviour, or aim ads at them (Section 9(3)). These start on 13 May 2027.
What a school may do
Law: An "educational institution" is exempt from Sections 9(1) and 9(3), but only for tracking and behavioural monitoring for its educational activities, or for the safety of its enrolled children (Fourth Schedule, Part A, item 3). The Schedule defines an educational institution as a place of learning, including vocational education.
Law: A transport provider hired by the school may track children's location during the journey, for their safety (Part A, item 5).
What a school may not do
Law: Any processing outside those conditions gets no exemption. Sections 9(1) and 9(3) then apply in full. Section 9(2) is never exempted for schools. You must not process a child's data in a way likely to harm the child's well-being.
Official text — DPDP Rules, 2025, Fourth Schedule, Part A, item 3
A Data Fiduciary who is an educational institution.
Processing is restricted to tracking and behavioural monitoring— (a) for the educational activities of such institution; or (b) in the interests of safety of children enrolled with such institution.
Edtech companies
Law: The Schedule names "educational institution". It does not name edtech companies. We do not say whether an edtech company counts. Part B purposes, such as an email-only account, apply to any Data Fiduciary that meets their conditions.
What the Schedule does not address
It does not say whether an edtech company is an educational institution. It does not list which classroom tools count as "educational activities". We do not guess at either.
Official text — DPDP Rules, 2025, Fourth Schedule
PART A
Classes of Data Fiduciaries in respect of whom provisions of sub-sections (1) and (3) of section 9 shall not apply
1. A Data Fiduciary who is a clinical establishment, mental health establishment or healthcare professional.
Conditions: Processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health.
2. A Data Fiduciary who is an allied healthcare professional.
Conditions: Processing is restricted to supporting implementation of any healthcare treatment and referral plan recommended by such professional for the child, to the extent necessary for the protection of her health.
3. A Data Fiduciary who is an educational institution.
Conditions: Processing is restricted to tracking and behavioural monitoring— (a) for the educational activities of such institution; or (b) in the interests of safety of children enrolled with such institution.
4. A Data Fiduciary who is an individual in whose care infants and children in a crèche or child day care centre are entrusted.
Conditions: Processing is restricted to tracking and behavioural monitoring in the interests of safety of children entrusted in the care of such institution, crèche or centre.
5. A Data Fiduciary who is engaged by an educational institution, crèche or child care centre for transport of children enrolled with such institution, crèche or centre.
Conditions: Processing is restricted to tracking the location of such children, in the interests of their safety, during the course of their travel to and from such institution, crèche or centre.
PART B
Purposes for which provisions of sub-sections (1) and (3) of section 9 shall not apply
1. For the exercise of any power, performance of any function or discharge of any duties in the interests of a child, under any law for the time being in force in India.
Conditions: Processing is restricted to the extent necessary for such exercise, performance or discharge.
2. For providing or issuing of any subsidy, benefit, service, certificate, licence or permit, by whatever name called, under law or policy or using public funds, in the interests of a child, under clause (b) of section 7 of the Act.
Conditions: Processing is restricted to the extent necessary for such provision or issuance.
3. For the creation of a user account for communicating by email.
Conditions: Processing is restricted to the extent necessary for creating such user account, the use of which is limited to communication by email.
4. For the determination of real-time location of a child.
Conditions: Processing is restricted to the tracking of real-time location of such child, in the interest of her safety and protection or security.
5. For ensuring that any information, service or advertisement likely to cause any detrimental effect on the well-being of a child is not accessible to her.
Conditions: Processing is restricted to the extent necessary to ensure that such information, service or advertisement is not accessible to the child.
6. For confirmation by the Data Fiduciary that the Data Principal is not a child and observance of due diligence under rule 10.
Conditions: Processing is restricted to the extent necessary for such confirmation or observance.