How do you get verifiable parental consent under the DPDP Rules 2025?
Confirm that the person consenting is an identifiable adult parent or guardian, using details your institute already holds or a DigiLocker or government-token route, and record which route you used for every child.
Last reviewed: Published: 8 min read
Quick answer: under section 9(1) of the DPDP Act and Rule 10 of the DPDP Rules 2025, an institute must obtain verifiable consent from a parent or lawful guardian before processing the personal data of anyone under 18, unless an exemption applies. Verification means you can show the consenting person is an identifiable adult. Two routes are described in our research notes: using identity and age details the institute already holds, or a DigiLocker or government-token route. Whichever you use, keep a record of the route per child. Attendance, academic progress and safety are exempt under Rule 12 and the Fourth Schedule; everything else generally needs consent. Rules apply from 13 May 2027 and the exact text should be confirmed with your lawyer.
Who counts as a child, and when is consent needed?
Under the Act, a child is anyone under 18. That includes every school student up to Class 12 and many coaching students. Consent from the parent or lawful guardian is needed before you process the child's data, unless the processing falls in the education exemption. Adult students (18+) consent for themselves; many droppers and government-exam aspirants are adults, and for them the student is the primary contact.
Which processing is exempt and which needs consent?
| Purpose | Consent from parent? | Note |
|---|---|---|
| Attendance and academic progress | Not needed | Educational activity (Rule 12, Fourth Schedule) |
| Safety and transport GPS during trips | Not needed | Child safety; transport location tracking during travel only |
| Publicity photos, marketing, analytics beyond education | Needed | Outside the exemption |
| AI tutor outside class work | Needed (default) | Treat as consent-required |
| Wellbeing analytics at a coaching centre | Needed (default) | Whether coaching centres count as educational institutions is untested |
| Targeted ads or marketing profiling | Never allowed | Section 9(3): no tracking, behavioural monitoring or targeted ads for children |
What practical verification options exist?
| Route | How it works in an institute | Strengths | Watch-outs |
|---|---|---|---|
| Details you already hold | At admission you verified the parent's identity and the child's age from documents; link the consent to that existing record | Cheap, no extra step for parents | Records must be current and match the person giving consent; ask your lawyer to confirm it satisfies Rule 10 for your case |
| DigiLocker or government token | The parent confirms identity and age through DigiLocker or a government-issued token | Strongest evidence of an identifiable adult | Needs parent smartphone and willingness; keep a manual route for families who cannot use it |
| Assisted consent at the office | A staff member checks the parent's original ID in person and records the route used | Works for low-literacy and low-connectivity families | Staff must be trained; log who verified, when and how |
What must the consent notice say?
- An itemised list of the personal data you collect and the purpose of each, in plain language and in Hindi and English at least.
- Links to withdraw consent, exercise rights (access, correction, erasure, nomination) and complain to the Data Protection Board.
- Image processing: if you scan documents or answer sheets (OCR), say so.
- AI sub-processors: if AI tools touch the data, name the sub-processors.
- The notice version and the date the parent saw it. Existing users must be told again when the notice changes.
What should you record for every child?
- Which parent or guardian consented, and the relationship.
- Which Rule 10 route was used (existing details, DigiLocker, government token, assisted).
- The purposes consented to, the notice version and the timestamp.
- How consent can be withdrawn, and a log when it is.
- The child's date of birth, so the system can alert you before the student turns 18 and consent can be collected again from the student.
How do you collect parental consent from hundreds of families?
Collecting verifiable parental consent in a school or coaching centre
Step 1: split purposes
Tag each purpose as consent-free (attendance, academics, safety) or consent-required (publicity, marketing, AI beyond class work, extra analytics).
Step 2: choose routes
Pick the verification route or routes you will offer, and keep an assisted office route so no family is excluded.
Step 3: publish the notice
Prepare the notice in Hindi and English, with the image-processing and AI disclosures, and version it.
Step 4: send consent requests
Send each parent a link by WhatsApp or SMS, or call them to the office. Record the route and the notice version on completion.
Step 5: chase and review
Follow up non-responders and track the percentage consented. Where consent is missing, stop the consent-required purposes for that child; keep the exempt ones.
Step 6: set the age-18 alert
Schedule a reminder to collect consent from the student when they turn 18, and update parent visibility settings.
What happens with siblings, separated parents and guardians?
Families rarely fit a single template, and a consent process that only works for two married parents with smartphones will fail the families who most need your school or centre to treat them fairly.
One parent can consent for several children, but record each child separately because purposes can differ. When parents are separated, decide in advance who is the lawful guardian on record and follow the court order if there is one. Where the person who pays fees is not the guardian (an uncle or an employer, for example), they can pay, but consent should come from the guardian. A parent's school and coaching memberships should be linked only when the parent confirms.
How can software help without taking over the decision?
A consent ledger can hold the route, notice version and timestamp, withdraw consent in one click, remind you at age 18 and block consent-required features for children without consent. The institute still decides the route. See the compliance centre and consent ledger and the DPDP readiness page.
Is a tick-box on the admission form enough?
Not by itself for verifiable consent. A tick-box records agreement but not that the person is an identifiable adult. Combine it with a verified identity record or one of the verification routes and keep the evidence.
Do we need consent to mark attendance?
No separate consent for attendance and academic progress, which fall in the education exemption. You still need a notice that says what you collect and why.
What if a parent refuses consent for photos?
Then do not publish the photos. Photos for publicity are consent-required, and refusal must not affect admission or teaching.
Can a coaching centre use the same exemption as a school?
Unclear. Whether coaching centres count as educational institutions under the exemption is untested, so default to consent for anything beyond core teaching.
Try the consent flow with demo data in a free trial or book a walk-through.
30-day free trial for up to 30 students, no card needed. You set up your own institute, with an optional sample setup to explore. The Free plan is for tutors.