How should a school handle APAAR IDs, consent and opt-out?

Quick answer: APAAR is a 12-digit student ID that is created through UDISE+ after an Aadhaar match. Parental consent is required. The Supreme Court (20 Jul 2026) requires an opt-out option and limits sharing of the data with private parties. Reports conflict on whether CBSE treats APAAR as mandatory or optional for the 2026-27 List of Candidates, so read the current circular. The best practice for a school is a consent register with an opt-out, an Aadhaar-name and date-of-birth pre-check before submission, and no sharing of APAAR data with third parties. Whether a third-party ERP acting as your processor may store APAAR IDs at all is an open legal question: our own software lets you switch storage off until your lawyer confirms.

What is APAAR and how is it different from PEN?

What did the Supreme Court say on 20 Jul 2026?

According to our research notes, the Supreme Court (20 Jul 2026) requires an opt-out option and limits sharing of APAAR data with private parties. We summarise it as a practical rule: do not make APAAR a silent condition of admission or exams unless the board circular for your class requires it, give parents an easy way to refuse, and share nothing with outside parties. Because this is a court direction and a single-source summary, read the order itself or ask your lawyer how it applies to your school and to the exams your students will take.

Is APAAR mandatory for CBSE students?

Reports are in conflict on whether APAAR is mandatory or optional for LOC 2026-27. Treat it as a configurable flag: if the circular for your class says it is required for the LOC, the flag is on and your process must still respect consent and the opt-out right, and if not, it is off. Do not guess. Check the CBSE circular for the year and your state education department if you are in a state board.

What should the APAAR consent register contain?

1. Student name, class and section, and the date of birth as per school records.
2. Parent or guardian name and relationship, and how they were verified (see the verifiable parental consent guide).
3. Decision: consented, refused (opt-out) or pending, with the date and the channel (paper, WhatsApp link, in person).
4. The notice version shown to the parent explaining what APAAR is, who sees the data and that sharing with private parties is limited.
5. Whether APAAR is required for LOC for this class under the circular you relied on.
6. The APAAR number or the creation status, stored only if your lawyer has confirmed that your software vendor may store it.
7. The date consent was withdrawn, if it was, and what you did next.

How do Aadhaar-name and date-of-birth mismatches arise?

APAAR creation uses an Aadhaar match, so a name or date of birth that differs between your school record and Aadhaar is the most common reason for failure. Common causes: initials versus full names, Hindi to English spelling, surname order, a different date of birth written in an old document. Run a pre-check before submission, list the mismatches, ask the parent to correct either the Aadhaar record or the school record, and keep a note of the resolution. Never store a full Aadhaar number in your ERP; the safe approach is to hold the last four digits and a keyed hash.

How do you run an APAAR drive step by step?

Can an ERP vendor store APAAR IDs?

This is unresolved in our research. A third-party ERP acts as your Data Processor, but the court's limit on sharing APAAR data with private parties may be read to include a vendor that stores it. Until a lawyer advises, a careful setup lets the school switch off APAAR storage in the ERP and keep APAAR purely in UDISE+. Acavya is built with an APAAR consent register, an opt-out, Aadhaar match pre-checks, a configurable "required for LOC" flag and a per-institute switch that turns APAAR ID storage off. See the DPDP guide for the general duties.