Your DPDP rights in Indian education, from Class 1 to college: the parent's playbook for schools, colleges and ed-tech apps

In October 2026 a mother in Bengaluru opens the SafeAnywhere parent app and sees that her 12-year-old daughter's school is sharing attendance and behaviour data with an ed-tech vendor she does not remember consenting to. She knows, vaguely, that the Digital Personal Data Protection Act 2023 is in force. She knows parents now have rights over their child's data. She does not know how to actually exercise one. She knows nobody who has. She closes the app and does nothing, because she cannot find the specific thing to do.

This piece exists to help close that gap, with the usual honest caveat: it is a parent-facing operational companion to the Act, not a legal opinion. It covers three of the Act's statutory rights (access, correction and erasure, and consent withdrawal) across the three Data Fiduciaries most Indian families interact with (the K-12 school, the college or university, and ed-tech apps). It gives sample letter language that you can adapt with your counsel, the indicative response window the operational practice has converged on, the age pivot that changes everything at 18, and the one-page rights slip (shown in the hero above) that is a starting template, not a filing document.

What this piece is and isn't

Because the subject is statutory and the stakes for a parent exercising a right are real, we want to be very clear up front:

• What this is: a plain-English, operationally-structured companion to the DPDP Act 2023 as it reads in October 2026, written for parents in the Indian education context. It names the rights, explains the age pivot at 18, suggests sample language for a letter, and points to the escalation path.
• What this isn't: legal advice; a template that can be sent as-is without legal review; a complete recital of the Act (which has additional rights, procedural specifics and sector-specific interactions this piece does not cover); or a substitute for engaging Indian counsel before any action with legal consequence.
• Why the hedging matters: the Draft DPDP Rules are still being refined; the Data Protection Board of India is being operationalised; sector regulators (CBSE, ICSE, UGC, AICTE, NAAC) are each updating their own circulars that interact with the Act. A specific procedural claim that is accurate in one month may be refined the next. The right posture for a parent exercising a right in October 2026 is informed, cooperative, counsel-advised.

Written for Indian parents whose children are in CBSE, ICSE, state-board or international schools, and for parents of college-going students at UGC-governed universities and AICTE-approved institutes. All operational claims below are time-stamped to October 2026 and should be re-confirmed against the current state of the Rules and Board guidance before use.

The three rights this piece covers, in plain English

The DPDP Act 2023 grants a Data Principal (the person whose data is being processed; your child, with you acting as their guardian under Section 9 until they turn 18) several statutory rights under Sections 11 to 14, together with the ability to withdraw consent under Section 6. The three most commonly exercised by parents in an education context are below. The Act also provides a right of grievance redressal (Section 13) and a right to nominate another individual to exercise rights in specified events (Section 14); those are outside this piece's scope. Confirm with your legal counsel which rights apply to your specific situation. The plain-English translations below are operational framings, not statutory quotations.

Right 1. Access the data held about your child

You can ask any Data Fiduciary processing your child's data to tell you: what data they hold, what they are using it for, with whom they are sharing it, and how long they will keep it. The Act requires response within a reasonable period; the final Rules will specify a timeline (operational practice in 2026 has converged on roughly 30 days from receipt of a written request, but confirm with counsel for your specific case). The response should be in a form you can read and keep (email, printed letter or a dashboard download).

Right 2. Request erasure of the data

You can ask the Data Fiduciary to delete your child's data when the purpose for which it was collected is complete, or when you withdraw consent, or when the data is no longer necessary. Not all data can be erased on request (statutory retention, legitimate welfare purposes, academic records required by law all stay); the response must tell you exactly what was erased and what was retained with the specific reason.

Right 3. Withdraw the consent that permits processing

Where consent is the legal basis for processing (admissions forms, parent-communication opt-ins, ed-tech app installs, promotional and research opt-ins), you can withdraw that consent at any time. Withdrawing consent does not retroactively make past processing unlawful; it stops future processing from the moment it is received. The Data Fiduciary must act on the withdrawal and may follow it with an erasure request as well.

All three rights are statutory. The Data Fiduciary cannot charge a fee for responding to a reasonable request. Repeated or excessive requests may be charged; a parent exercising one right per child per year will not meet that threshold.

The age pivot: your role at under-18 vs 18+

The single most important thing to understand about DPDP in an education context is the age pivot. The Act defines a "child" as a person under 18. Processing of a child's data requires verifiable parental consent; the parent exercises the rights on the child's behalf. At 18 the child becomes an adult Data Principal in their own right, and the parent's statutory role ends.

In practical terms:

• Child in K-12 school (ages 4 to 17 or 18 depending on the school): you exercise all three rights. The school's responses come to you.
• Child at a college or university (ages 18+ for most undergraduates): the student exercises their own rights. The college is their Data Fiduciary, not yours. Your role becomes advisor: you can help them draft the letter, understand the Act, think through the implications. You cannot formally request on their behalf.
• Child using an ed-tech app at under 18: you exercise the rights, because the app is processing a child's data and your consent is what permits that processing.
• Child using an ed-tech app at 18+: they exercise the rights. The app is their Data Fiduciary.

Some edge cases: a 17-year-old in Class 12 who turns 18 mid-year has mixed status (parent-side rights for the time they were 17; student-side rights going forward). A pupil whose school keeps academic records past their 18th birthday has mixed status (parent-side for the pre-18 records; student-side for post-18 updates). Your legal counsel can advise on the specifics; the operational default is "parent exercises until 18, student exercises after."

Three rights. Three Data Fiduciaries most families touch. One age pivot at 18. Save the one-page slip at the top of this piece; you now have the shape of the playbook.

Exercising Right 1 (Access) against each Data Fiduciary

Against a K-12 school

Who you send it to: the Principal, with a copy to the designated Data Protection Officer if the school has one, or to the Vice-Principal otherwise. Email is acceptable; a signed hard copy strengthens the request.

Letter copy (fill in the brackets):

Sample language only. Adapt with your legal counsel before sending; do not forward verbatim.

Dear [Principal's name],

Under the Digital Personal Data Protection Act 2023, I am exercising the right of my child [child's name, Class and section] to access the personal data your school holds about them. Please provide, within the applicable response period under the Act and the DPDP Rules as currently in force:
(a) a complete list of categories of personal data the school holds about my child;
(b) the purpose for which each category is held;
(c) the third parties, if any, with whom any category has been shared;
(d) the retention period applicable to each category.

I would be grateful for the response in writing by email to [your email].

Yours sincerely,
[your name], parent / guardian of [child's name]
Date: [date]

What a well-run school's response typically contains (practice varies by institution; your specific school's data-handling policy is the authoritative source): an itemised list usually covering admissions file, academic records (marks, promotion history), health and immunisation records, counselling notes (practice varies on verbatim vs summary; schools often provide summaries both for the child's welfare and to protect third-party identities), filter and ICT logs, attendance, fee records, photographs, transport data, and any third-party sharing (ed-tech vendors, exam boards, inspection authorities). The schools compliance piece covers the seven DPDP layers from the school's side, which is useful context for interpreting the response.

Against a college or university (student is 18+, exercises their own right)

Who the student sends it to: the designated Data Protection Officer where the college has one, or the Registrar's Office otherwise. For UGC-governed universities, the Dean of Students' office is a common secondary route.

Letter copy (student fills in):

Sample language only. Adapt with legal counsel before sending.

Dear [DPO / Registrar's name],

Under the Digital Personal Data Protection Act 2023, I am exercising my right as a Data Principal to access the personal data the institution holds about me. Please provide, within the applicable response period under the Act and the Rules as currently in force:
(a) a complete list of categories of personal data held about me, including academic records, hostel records, library and lab-PC activity logs, financial records, placement-cell records and health or counselling notes;
(b) the purpose for which each category is held;
(c) the third parties, if any, with whom any category has been shared;
(d) the retention period applicable to each category;
(e) specifically for lab-PC and library-terminal activity logs, the time window the institution retains these for.

Yours sincerely,
[student name], [Course, Year, Roll Number]
Date: [date]

What the student should get back: academic transcripts, hostel allotment history, library and lab-PC session logs (session length and times, not keystrokes or content, which the institution does not and should not hold), fee and financial records, placement-cell interactions, counselling notes in summary form, any disciplinary records. The PTM agenda piece covers the operational rhythm on the school side; the equivalent at a college is the Dean of Students' office.

Against an ed-tech app

Who you send it to: the DPO or privacy contact listed in the app's own privacy policy. Compliance-engaged ed-tech apps publish a DPO email in-app or in the privacy policy; the specific contact is best confirmed by opening the app's privacy policy on the day of use (compliance posture is a moving target and this piece deliberately does not name or rank specific apps). Where the app has an in-app "data request" flow, use that; it is faster and automatically creates a record.

Letter copy:

Sample language only. Adapt with legal counsel before sending.

Dear [DPO name or "Data Protection Officer"],

Under the Digital Personal Data Protection Act 2023, I am exercising the right of my child [child's name, DoB, child's registered account email] to access the personal data your platform holds about them. Please provide, within the applicable response period under the Act and the Rules as currently in force:
(a) a complete list of categories of personal data held about my child, including account registration data, usage activity (sessions, lectures watched, quizzes attempted), payment history, device and location data, and any inferred data such as learning-profile scores;
(b) the purpose for which each category is held;
(c) the third parties, if any, with whom any category has been shared (analytics providers, advertising networks, parent companies);
(d) the retention period for each category.

Yours sincerely,
[your name], parent of [child's name]
Date: [date]

What you should get back: a usage data export (what videos were watched when, which problems attempted, test scores), account registration metadata, payment history, device fingerprints the app has captured, inferred learning-profile data, third-party sharing map (notably: advertising networks, analytics providers, parent company data flows). Reviewing the sharing map is often the most eye-opening part; many ed-tech apps share aggregate or pseudonymous data with multiple downstream partners.

Exercising Right 2 (Erasure) against each Data Fiduciary

Against a K-12 school

The honest reality: schools can erase on request, but not everything. Academic records are typically retained statutorily until the student completes schooling and often beyond. Welfare and counselling notes may be retained where there is a documented safeguarding reason. The erasure request still works for: outdated contact information, old photographs, defunct ed-tech vendor integrations, promotional opt-ins, non-essential research consents.

Letter copy addition (add to the Right-1 template):

Further, I request the erasure of the following categories of personal data held about my child, which are no longer necessary for a lawful purpose: [list specific categories, e.g. "photographs taken for school promotional material and not required for academic records", "contact details of former emergency contacts no longer in that role", "subscription to the school's third-party ed-tech partner [name] which my child no longer uses"]. Where any requested category cannot be erased, please state the specific legal or operational reason for retention.

A compliance-engaged school's response typically lists what was erased and what was retained with the reason, within the applicable response period. A "no, it is required by [specific regulation]" is a legitimate response; a "no, we need it" without reason is one to raise with your counsel.

Against a college (student exercises)

Similar pattern to schools; academic records are typically retained for the duration of enrolment and years afterward per UGC guidelines. The erasure request works best for: historical disciplinary records that have been resolved, old hostel allotment records, non-essential marketing consents, former placement-cell interactions, outdated contact details. Lab-PC and library-terminal session logs are often held for 90 days to 1 year; the student can request erasure of logs beyond their useful lifetime.

Against an ed-tech app

The strongest erasure case. Ed-tech apps typically have minimal statutory retention requirement for individual usage data; much of what they hold is "legitimate business interest" rather than "required by law". A full-account erasure (account closure + full-data deletion) is the parent's cleanest option when a child stops using an app. In-app flows for account deletion must now exist under the Act; where they do not, a written request to the DPO is the starting point and triggers the applicable response window. Note: the app typically retains payment and legal-compliance records (tax, GST) even after account closure; these are legitimate exclusions.

Exercising Right 3 (Consent withdrawal) against each Data Fiduciary

Consent withdrawal is the most powerful of the three rights because it stops future processing without necessarily triggering erasure of past data. Use it when you want the processing to end but don't need the historical record removed. Common examples: withdrawing consent for a school's third-party ed-tech integration; withdrawing consent for an app's advertising-use of data while keeping the account active; withdrawing consent for inclusion in alumni / parent-engagement research.

Against a K-12 school

Sample language only. Adapt with legal counsel before sending.

Dear [Principal's name],

Under the Digital Personal Data Protection Act 2023, I am withdrawing my consent for the following specific processing activities relating to my child [child's name, Class, section]:
(a) [specific activity 1, e.g. "sharing of academic data with the school's ed-tech partner [name]"];
(b) [specific activity 2, e.g. "use of my child's photograph in school promotional material"];
(c) [specific activity 3, e.g. "inclusion in parent-engagement surveys conducted by third parties"].

I acknowledge this withdrawal applies to future processing from the date of receipt of this notice. Please confirm the processing has stopped within the applicable response period and specify any downstream consequences, such as loss of access to specific services, that result.

Yours sincerely,
[your name], parent / guardian of [child's name]
Date: [date]

Against a college (student exercises) and against an ed-tech app

Same structure; replace the specific activities with those relevant to the Data Fiduciary. For ed-tech apps, the most common consent withdrawals in 2026 are: push notifications beyond essential service notifications, advertising use of behavioural data, in-app chat and community features, data-sharing with parent companies for cross-platform marketing.

The response window and the escalation path

The Act requires a response within a reasonable timeframe; the specific window will be fixed by the final DPDP Rules. Operational practice in 2026 has converged on approximately 30 days from receipt, but confirm the current position with your counsel before relying on any specific number. If the applicable window passes without a response, a typical escalation path (illustrative; your counsel will advise on current routes) is:

1. Written reminder to the same Data Fiduciary, referencing the original request date and the applicable statutory window. A short additional period is customary.
2. Formal grievance to the Data Fiduciary under Section 13 of the Act, which creates a right of grievance redressal.
3. Escalation to the Data Protection Board of India via its published channels once operational. The Board is being operationalised through 2026; check meity.gov.in for the current status, the complaint-filing mechanism and any sectoral guidance. The Board, when operational, can direct the Data Fiduciary to respond and impose penalties.
4. Where broader child-protection concerns are also engaged, NCPCR (National Commission for Protection of Child Rights) may be an additional channel for matters within its remit; the primary DPDP route remains the Board.
5. Legal counsel for serious or persistent cases. Your counsel will advise on civil, regulatory or sector-specific routes appropriate to the matter.

In October 2026 the current posture is primarily cooperative-institution; most parent requests are resolved at step 1 or step 2 with compliance-engaged schools and apps. The enforcement curve is tightening through 2026 and 2027; the specific routes above should be re-confirmed against the current state of the Rules and Board guidance at the time of use.

Enforcement timing in October 2026, honestly

Key dates we are confident of: the DPDP Act was passed in August 2023. The Draft Digital Personal Data Protection Rules were notified for consultation in January 2025 and are being refined. The Data Protection Board of India is being operationalised through 2026; the current status of appointments, the complaint-filing mechanism and the Board's published guidance are available on meity.gov.in. Penalties on paper reach Rs 250 crore for certain breach categories under Schedule 1 of the Act; the specific penalty applicable to any given situation is a matter for the Board when it exercises jurisdiction.

The practical reality for a parent exercising a right in October 2026 is primarily a cooperative-institution interaction: a compliance-engaged school, college or ed-tech app typically responds within a reasonable window; a reminder letter usually resolves the rest. The enforcement curve is tightening through 2026 and 2027 as the Rules are finalised and the Board becomes fully operational. Your legal counsel can advise on current escalation routes, which are the single area most likely to shift between now and the time this piece is read.

Common questions parents and students ask about DPDP rights

What if the school says they do not know how to respond to a DPDP request?

Many Indian schools in October 2026 are at the "aware but still operationalising" stage with DPDP. A polite reminder letter citing the Act and the Draft DPDP Rules (notified for consultation in January 2025 and being finalised through 2026) typically prompts the school to escalate internally. If still no response, the schools compliance piece on this site is a useful share: it walks the school through the seven DPDP layers from their own side.

What if my child's school outsources all data processing to an ed-tech vendor?

Does not change your rights. The school remains the Data Fiduciary; the ed-tech vendor is a Data Processor. Your request goes to the school; the school is responsible for coordinating with the vendor to fulfil the request within the SLA.

Can I exercise a right on behalf of my adult (18+) college-going child?

No, not statutorily. At 18 your child is a Data Principal in their own right and must exercise the right themselves. You can help them draft the letter, understand the Act, think through implications; the signature and the request must be theirs. The college will respond to them, not to you.

What about my child's lab-PC and library-terminal activity logs at a college?

These are personal data about the student under DPDP. The college holds them as Data Fiduciary; typical retention is 90 days to 1 year. The student can request access (what sessions, when, which terminal), erasure (anything beyond operational need), or consent withdrawal (where consent was the basis for retention). The cross-platform ratings piece covers the related question of what the apps and content the student accesses are rated for.

Does DPDP apply to foreign ed-tech apps used by Indian students?

Yes, where they process personal data of individuals located in India. The Act applies to Data Fiduciaries regardless of location when processing Indian-located individuals' data (see Section 3 for the specific scope). The specifics of extra-territorial application are an area where your legal counsel can advise for a particular app and situation.

What if I withdraw consent and the school says my child cannot continue to be enrolled?

Depends on what the consent was for. Withdrawing consent for "sharing data with the school's ed-tech partner [X]" cannot be used to deny enrolment, because enrolment does not require that specific consent. Withdrawing consent for "maintaining academic records necessary for enrolment" is a different matter; the school may legitimately say the consent is foundational to the service. The Act's "legitimate uses" provisions cover processing necessary for the specified educational service; those stay in place even if you withdraw consent for ancillary processing.

Can I ask to see the counselling notes about my child?

Sensitive area. Practice varies by institution. Under the Act you may request access to personal data processed about your child; the exact form of the response for counselling records (verbatim vs summary) depends on the institution's own policy, the welfare context (counselling-record privacy supports the therapeutic relationship) and the protection of third-party identities (other pupils mentioned, etc.). Your legal counsel is the right person to advise on specific cases where you believe the response is insufficient; your institution's documented data-handling policy is the authoritative source on their actual practice.

What does a well-run ed-tech app's DPDP response look like in 2026?

A compliance-engaged ed-tech app typically returns, within a reasonable response window, a structured JSON or PDF export covering account data, usage history, inferred profile data, and a list of third-party sharing. An in-app "download my data" flow is becoming an industry norm. Where an app's response is slower than expected, a letter campaign of parent-exercised requests tends to accelerate implementation; we are not naming or ranking specific apps on compliance posture, which is a moving target and best confirmed directly with the app's DPO.

What role does SafeAnywhere play in all this?

SafeAnywhere is itself a Data Processor under DPDP when integrated by a school or family. We hold a documented data-processing agreement with each institutional customer; we respond to pass-through access and erasure requests within our own SLA. On the family side, the parent app's weekly review (see the weekly review piece) surfaces the ed-tech apps your child actually uses, which is often the gap between "apps you knew about" and "apps the Act gives you rights over". Knowing which apps the child uses is the pre-requisite for exercising the rights.

Where can I follow DPDP enforcement updates in 2026?

The Ministry of Electronics and Information Technology (MeitY) publishes Rules updates; the Data Protection Board of India (as it operationalises through 2026) will publish decisions and guidance; NCPCR publishes children's-data-adjacent circulars; the sector-specific regulators (CBSE, ICSE, UGC, AICTE, IRDAI, RBI) publish circulars that interact with DPDP within their domains. For a parent, the single most useful source is the MeitY DPDP page and the Board's publication channel once active.

The honest bottom line

The DPDP Act 2023 gives you statutory rights over your child's data; three of them (access, correction and erasure, consent withdrawal) are the ones you will exercise most often in an education context. The operational shape is the same across K-12 schools, colleges and ed-tech apps; the letter copy and the specific categories differ. The age pivot at 18 shifts the right-holder from the parent to the student. The response window will be fixed by the final Rules; operational practice in 2026 is converging on roughly 30 days. Enforcement in October 2026 is primarily cooperative-institution. Save the one-page rights slip at the top of this piece as a conversation starter; have a lawyer-reviewed version in hand before you send any specific request; see what you get back.