DPDP Act for Coaching Institutes, Schools and Edtech: Using Class 10 Student Data Responsibly
By the Digiboss Team | Last updated: 17 October 2026 | Questions? Write to help@digiboss.in
Disclaimer: This article is general information, not legal advice. Laws and rules change. Speak to a qualified lawyer about your specific situation.
Many Class 10 students are 15 or 16 years old. That means anyone running admission campaigns with student contact data should understand the DPDP Act for coaching institutes, schools and edtech businesses. This guide explains the basics in plain language and lists practical habits that protect families and your brand.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India’s main law on processing digital personal data. The government notified the Digital Personal Data Protection Rules, 2025 in November 2025 and set a phased rollout. According to published summaries of the notified timeline, the substantive duties, including those on notice, consent and children’s data, apply about 18 months after notification, that is from 14 May 2027. Check the official text on the MeitY website for the current position.
Why it matters for Class 10 audiences
Under the Act, a “child” is a person under 18. The law generally requires verifiable consent from a parent or lawful guardian before processing a child’s personal data, and it restricts tracking, behavioural monitoring and targeted advertising directed at children. The Rules provide limited exemptions for certain organisations, including some educational institutions, for specified purposes only. Whether a particular marketing activity qualifies is a legal question, not an assumption to make.
Other rules that already apply to marketing
| Area | What to know |
|---|---|
| Commercial SMS and calls | TRAI rules require registration on DLT platforms, approved headers and templates, and respect for Do Not Disturb preferences. See TRAI. |
| The platform’s business messaging policy expects people to have opted in to receive business messages. | |
| Advertising claims | Do not make misleading claims such as guaranteed ranks or selections. |
| Existing IT laws | Other Indian laws on data security and information technology continue to apply. |
Practical best practices
- Know your data source. Ask the seller or partner how data was gathered and keep the answer on file.
- Prefer parent-directed communication. Address messages to parents or guardians where possible.
- Be clear about purpose. Use student data only for the admission or education purpose you state. Do not resell or share it casually.
- Offer and honour opt-outs. Add “Reply STOP to opt out” and remove those numbers from all lists the same day.
- Collect only what you need. Name, class, state and a contact number are usually enough for outreach.
- Secure the file. Use passwords, limit staff access and delete old files you no longer need.
- Keep simple records. Note when and how people opted in or out.
- Train your team. Counsellors and callers should know what they can and cannot say.
- Avoid timing that pressures students. Skip late-night messages and exam-period spam.
- Review regularly. Revisit your practices as the rules and guidance evolve.
Questions to ask a data seller
- How was this data compiled?
- What exactly do the fields contain?
- How old is the data?
- Is there any record of opt-in or notice?
- What do you expect me to do to use it lawfully?
Reputable sellers will answer clearly. If you get vague replies, treat it as a risk signal. Our buying checklist covers this in more detail.
About this guide
Digiboss sells a Class 10 student database for education outreach. Our product page states that buyers are responsible for complying with applicable data protection and anti-spam rules, and we say the same here: lawful use is the buyer’s responsibility, so plan your campaigns accordingly.
Key takeaways
- Under 18 means child under the DPDP Act, with extra obligations.
- Phased rules are in place; check official sources for current dates.
- Use parent-directed, purposeful and opt-out-friendly communication.
- Combine DPDP awareness with TRAI and WhatsApp requirements.
- Get legal advice for your specific campaigns.
Frequently Asked Questions
Does the DPDP Act apply to student data used for admission marketing?
The Act covers digital personal data of individuals, including students. Anyone under 18 is a child, so additional rules on parental consent and targeted advertising can apply. Take legal advice for your use case.
When do the DPDP children's data rules apply?
The Rules were notified in November 2025 with a phased timeline, and published summaries put the main substantive obligations at 14 May 2027. Verify on the official MeitY site.
What should I do before messaging Class 10 students?
Know your data source, prefer parent-directed messages, use DLT-approved templates for SMS, include an opt-out and keep simple records.