DPDP Act for EdTech platforms

Verifiable parental consent, in practice

"Verifiable" means more than a checkbox that says "I am a parent". Your flow needs an age gate at signup, a parent contact captured separately from the student, a confirmation action performed by the parent on their own device, and a stored record linking the three.

Keep the consent record for as long as the account exists, and re-collect when the purpose materially changes — for example, when you launch a feature that shares progress data with a third-party tutor.

• Age declaration before any account is created
• Parent or guardian identity captured and separately confirmed
• No behavioural tracking or ad personalisation on child accounts, regardless of consent
• An audit record per consent event, retained for the account lifetime

Your marketing site is not exempt

The prohibition applies to processing a child's data. If your homepage runs a Meta Pixel and prospective students visit it, you cannot rely on a generic banner to make that lawful. Categorise advertising trackers strictly and be prepared to disable ad personalisation for the flows most likely to be used by minors.

Data Principal rights and the request queue

Chapter III of the Act gives every Data Principal the right to access a summary of their personal data and the processing performed, the right to correction and completion, the right to erasure, and the right to nominate someone to exercise those rights on their behalf. You must publish a way to make those requests and you must respond within a reasonable period.

For a small team, the failure mode is not refusing a request — it is losing one. Requests arrive by email, WhatsApp, a contact form and Instagram DM, and nobody owns the spreadsheet. A single intake endpoint with an auditable status trail removes that risk entirely, which is why the AssentRepo banner ships a built-in DSAR form alongside the cookie controls.

You have to be able to prove it

The obligation that catches most teams out is evidentiary. Under Section 8, the Data Fiduciary — you — is responsible for demonstrating compliance, including that valid consent was obtained. If the Board asks and your answer is "our banner was live", that is not evidence.

A defensible consent record contains, at minimum: a stable visitor identifier, the categories accepted and rejected, a UTC timestamp, the version of the notice shown, the policy text hash, and enough network context to establish the request was genuine without storing raw personal identifiers. AssentRepo writes exactly this record for every consent event and one-way hashes the IP address with a server-side salt, so the log is useful to an auditor and useless to an attacker.

Frequently asked questions