Your Users Are Children. That Changes Everything.
For most sectors section 9 is an edge case handled by an age gate. For education it is the centre of the compliance problem, because the Act's definition of a child covers most of the student body.
Covers: schools, colleges, coaching centres, test prep, K-12 platforms, training institutes.
Why this sector is treated differently
The Act defines a child as an individual who has not completed eighteen years of age. In a school, a coaching platform or a K-12 product, that is not a minority of users to be screened out - it is the user base. Section 9 therefore stops being a peripheral control and becomes the architecture.
Three duties follow. Section 9(1) requires verifiable parental consent before processing a child's personal data, in the manner prescribed by rule 10. Section 9(2) prohibits processing likely to cause a detrimental effect on a child's well-being. Section 9(3) prohibits tracking, behavioural monitoring of children and targeted advertising directed at children, outright and without a consent override.
Section 9(3) is the one that reaches furthest into an EdTech product, because the line between pedagogy and behavioural monitoring is not obvious. Adaptive learning that adjusts difficulty from a student's answers is doing something a lawyer might characterise as behavioural monitoring, and so is engagement scoring, attention tracking in a proctored exam, and a recommendation engine that surfaces the next course. Some of that is the product working as intended for the learner's benefit; some of it is profiling. The Act does not draw the line for you, which means you have to draw it deliberately and be able to explain it.
There is relief in the framework, and its extent depends on your class. Section 9(4) allows classes of Data Fiduciary and purposes to be prescribed as exempt from sections 9(1) and 9(3), and rule 12 with Part A of the Fourth Schedule does that - beginning with clinical and mental health establishments. Whether and how far it reaches educational providers is a question to answer against the Schedule text for your specific class and purpose, not to assume.
What you actually process
One row per activity, not per data type. Lawful basis and erasure attach to a purpose, so the same phone number can sit in three rows below with three different answers.
| Activity | Lawful basis | When it must go |
|---|---|---|
| Enrol a learnerLearner name, Class or grade, Date of birth, Parent or guardian contact, School | § 9(1)Verifiable consent of the parent or lawful guardian before processing a child's personal data, in the manner rule 10 prescribes. A school is generally neither parent nor guardian. | § 8(7)Erase when the learner leaves and the purpose is served, unless an education record obligation applies from another statute. |
| Deliver adaptive learningAnswers, Time on task, Attempts, Progress | § 9(3)Tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright, with no consent override. The Act does not draw the line between teaching and profiling, so you must draw it and be able to explain it. | § 8(7)Learning data serves the course. Set a period against that, not against the life of the account. |
| Report to the institutionAttendance, Scores, Progress, Behavioural flags | § 8(2)Where the institution determines purpose and means, you are a Data Processor and may act only under a valid contract. The Fiduciary remains responsible under section 8(1) irrespective of any agreement to the contrary. | § 8(7)Cease and erase on the Fiduciary's instruction, including copies the school has exported where you control them. |
| Market to parentsParent contact, Learner progress, Purchase history | § 6Marketing to a parent is ordinary processing of the parent's data, needing consent specific to that purpose. It does not inherit the basis that supports teaching the child. | § 8(7)Erase on withdrawal, across every channel. |
The data flow, and where it breaks
Each lane follows one activity through the actors and systems that touch the data. The failure mode sits on the hop where it happens, rather than in a list somewhere else on the page.
Enrol a learner
Create the account and establish who may consent for it
- Enrolment formCollects learner and guardian details§ 5Fails when: Notice addressed to the learner, who cannot give the consent being relied on
- Parent verificationObtains verifiable parental consent§ 9(1)Fails when: A tick box the learner completes claiming to be a parent
- School procurementSigns the contract on the institution's behalf§ 8(2)Fails when: The school treated as able to consent in the parent's place, which section 9(1) does not provide for
- Learner recordHolds the profileFails when: No route to withdraw, so consent is a one-way door
Deliver adaptive learning
Teach this learner by adjusting to their answers
- Learning clientRecords answers and timingFails when: One event stream serving both teaching and profiling with no line drawn between them
- Adaptive engineAdjusts difficulty from performance§ 9(3)Fails when: Adjustment indistinguishable from building a persistent behavioural profile
- Engagement analyticsScores attention and streaks§ 9(3)Fails when: Engagement optimisation aimed at children, which is behavioural monitoring however it is labelled
- ReportingShows progress to teacher and parent§ 9(2)Fails when: Rankings that affect a child's wellbeing surfaced without thought
Report to the institution
Give the school the data it needs to run the programme
- PlatformAggregates learner data§ 8(1)Fails when: Acting on your own initiative on data the school controls
- School dashboardPresents it to staff§ 8(2)Fails when: Broad staff access with no role separation
- ExportLeaves the platform as a fileFails when: Spreadsheets of children's data on personal devices, outside every control you built
Market to parents
Sell the next course or renewal
- CRMSegments on learner performance§ 6Fails when: A child's academic performance used as a marketing signal
- Campaign toolSends to the parent§ 8(2)Fails when: Vendor engaged with no processing terms
The provisions that apply
Verifiable parental consent
Before processing any personal data of a child, or of a person with a disability who has a lawful guardian, the Data Fiduciary must obtain verifiable consent of the parent or lawful guardian, in the manner prescribed. Rule 10 sets out that manner. "Verifiable" is doing real work - a checkbox asserting parenthood is not the standard the word implies.
No behavioural monitoring, no targeted advertising
Tracking, behavioural monitoring of children and targeted advertising directed at children are prohibited. There is no consent gate: a parent cannot authorise it. For adaptive learning, engagement analytics and recommendation systems, the question is whether the feature constitutes monitoring - not whether anyone agreed to it.
No detrimental effect on well-being
A Data Fiduciary shall not undertake processing of personal data that is likely to cause any detrimental effect on the well-being of a child. This is broader and vaguer than the other two, and it is the provision most likely to be cited against engagement-maximising design - streaks, leaderboards and notification pressure aimed at minors.
The prescribed exemptions
Section 9(4) allows sections 9(1) and 9(3) to be disapplied for prescribed classes, purposes and conditions. Rule 12 with Part A of the Fourth Schedule implements this, beginning with clinical establishments, mental health establishments and healthcare professionals. Read the Schedule against your own class and purpose before relying on it.
What to do about it
Classify every feature as pedagogy or profiling
Go through the product feature by feature and record which are necessary to deliver learning to that student and which build a behavioural profile. The classification is the compliance artefact - it is what you will be asked to produce, and making the call in advance is far easier than defending an unexamined one.
Design verifiable parental consent as a real flow
It needs to establish that the consenting adult is the parent or lawful guardian, produce a durable record, and cope with the school-procured case where the institution - not the parent - signs the contract. Rule 10 governs the manner, and it should be built once, centrally, rather than per product surface.
Remove advertising from minor-facing surfaces
Targeted advertising directed at children is prohibited outright. If any part of the product is ad-supported, the safe position for under-eighteen accounts is contextual-only inventory, verified across every mediation partner rather than assumed from a flag.
Separate the institution's role from yours
When a school deploys your platform, work out who determines the purpose and means. If the school does and you act on its instructions, you look like a Data Processor and section 8(2) requires a valid contract. If you decide what to do with student data yourself, you are a Data Fiduciary with the full set of duties, including section 9.
Sequence the work
The same controls as above, in the order they are worth doing. Each names the evidence you would put in front of an auditor, because a control you cannot evidence is a control you cannot prove you had.
Build the foundation
Get the lawful basis and the roles right. Everything else assumes these are settled.
- Enrol a learnerBuild parental consent once, centrally, and settle the roles: usually the institution determines purpose and means as Data Fiduciary while the platform acts as Data Processor under section 8(2), with the school obtaining consent.Evidence: The consent record with method and timestamp, and the contract that fixes which party is Fiduciary and which is Processor.
Operationalise it
Turn the basis into systems that run without anyone remembering to run them.
- Deliver adaptive learningClassify every feature as pedagogy or profiling before anyone asks. Adjusting difficulty to teach this learner is defensible; a persistent behavioural profile and engagement optimisation are not.Evidence: A feature-by-feature classification with the reasoning, plus what is retained, for how long, and what else it feeds.
- Market to parentsKeep learner performance out of marketing segmentation, and take separate consent from the parent in their own right.Evidence: Consent records for the parent, and a segmentation policy excluding learner performance.
Keep it honest
Prove it still works, and answer the people whose data it is.
- Report to the institutionFix the roles in the contract and make them true in the product: role-based access, and exports that are logged rather than silent.Evidence: The processing contract, the access model, and an export log.
Section and Schedule references above point at the statute itself. Read them in context in the full text of the Act, or against the MeitY publication. This is an educational summary, not legal advice for your organisation.
EdTech & education: common questions
Can a school consent on behalf of parents?
Section 9(1) requires verifiable consent of the parent or lawful guardian. A school is generally neither. Where an institution procures the platform, the workable structure is usually that the school is the Data Fiduciary determining purpose and means, the provider is a Data Processor under a section 8(2) contract, and the school obtains parental consent. That arrangement has to be real in substance, not just in the paperwork.
Is adaptive learning behavioural monitoring under section 9(3)?
The Act does not answer this directly, which is the honest position. Adjusting difficulty from a student's answers to teach that student is a different activity from building a persistent behavioural profile, and the distinction is defensible - but it needs to be documented before it is challenged, with a clear account of what is retained, for how long and what else it is used for.
Does section 9 apply to university students over 18?
No. A child is someone who has not completed eighteen years, so section 9 does not apply to adult learners. Every other obligation does: notice, consent, purpose limitation, erasure, security safeguards and the Chapter III rights all apply to an eighteen-year-old student exactly as to any other Data Principal.
Know this well enough to prove it
The certification is a free, graded 15-question exam covering the Act end to end, not just this sector. Pass mark is 70%.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against EdTech & education implementation guide. Educational information, not legal advice.