--- title: "Schools, colleges and ed-tech apps (children's data): your rights..." description: "Children's data, school apps, verifiable parental consent and ed-tech selling. Plain steps, helplines and templates." url: "https://dpdpr.in/rights/schools-edtech/" canonical: "https://dpdpr.in/rights/schools-edtech/" site: "dpdpr.in" updated: "2026-11-02" disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY." --- # Schools, colleges and ed-tech apps (children's data): your rights and how to complain Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step. ## What data they hold - Your child's name, age, class, photos, marks and attendance. - Parents' phone numbers, address and income documents. - On apps: usage, location, videos and sometimes camera or microphone access. ## Your rights under current law - The Ministry of Education's advisory of 23 December 2021 warns parents about ed-tech companies that push auto-debit mandates and 'free' offers, and advises keeping evidence of spam calls and forced sign ups. - Ed-tech refund and selling problems are consumer complaints: the company first, then the National Consumer Helpline (1915). - Child rights violations can be reported to NCPCR on e-Baal Nidan. ## Your DPDP rights once in force Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both. From 13 May 2027, section 9 says a company must get verifiable consent of a parent before processing a child's data (a child is anyone under 18), must not process it in a way likely to harm the child, and must not track, behaviourally monitor or target ads at children. Rule 10 says the company must check that the person giving consent is an identifiable adult, using details it already holds or an age and identity token, for example through DigiLocker. The Fourth Schedule allows schools to track and monitor children only for educational activities or safety, and school transport to track location only during travel, without parental consent. - Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)). - Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)). - Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)). - Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)). - Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)). ## Common problems - A school app that shares children's photos publicly. - Ed-tech sales calls after a school test or event. - Auto-debit started without clear consent. - Children's data used for advertising. ## Evidence to keep - Screenshots of the app or post. - Call log of sales calls and what they knew about your child. - Bank statement showing the auto-debit. - Your letter to the school or company and its reply. See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/). ## How to approach, step by step Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first. ### Write to the company's grievance officer Most apps and websites must name a grievance officer. E-commerce sites, ride apps and platforms such as job portals, dating and matrimony apps all have one under the rules that apply to them. **Keep this ready before you start:** - Your account ID, registered mobile or email, and order or booking number. - Screenshots and dates. - What you want: delete my data, stop calls, refund, remove a profile. 1. Open the app or website. Look for **Grievance Officer**, **Contact us** or **Privacy policy**. The officer's name and contact must be shown there. 2. Write a short complaint. Use the template on this page. 3. Attach screenshots. 4. Send it. Save the acknowledgement or ticket number and the date. 5. Wait for the time limit for that kind of company (shown in the time limits on this page). 6. If there is no reply, send one reminder with your ticket number. 7. Then go to the next step on this page. Checked on 1 November 2026 against: [National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020](https://consumerhelpline.gov.in/faq-details.php?fid=E-Commerce), [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa). ### National Consumer Helpline, then the Consumer Commission The National Consumer Helpline (NCH) is run by the Department of Consumer Affairs. It forwards your complaint to the company and tracks the reply. If that fails, you can file a case before a Consumer Commission on e-Jagriti. **Keep this ready before you start:** - Bill, invoice, order ID or account number. - Your complaint to the company and its reply, if any. - Screenshots and dates. 1. Call **1915** or **1800114000** (8 AM to 8 PM), or WhatsApp **+91 8800001915**. 2. Or open [consumerhelpline.gov.in](https://consumerhelpline.gov.in/public/) and click **Register Grievance**. You can also use the NCH app or the UMANG app. 3. Describe the problem, the company and what you want. 4. Save the grievance number you are given. 5. Use **Track Your Grievance** to see the company's reply. Use **Upload Documents** to add proof. 6. If the company still does not fix it, you can file a consumer case on [e-Jagriti](https://e-jagriti.gov.in), the official portal for Consumer Commissions. It uses OTP registration, online fees and virtual hearings. 7. File the case within 2 years of the problem. This is the limit in section 69 of the Consumer Protection Act, 2019. Checked on 1 November 2026 against: [National Consumer Helpline (Department of Consumer Affairs)](https://consumerhelpline.gov.in/public/), [e-Jagriti: file a case before a Consumer Commission](https://e-jagriti.gov.in/). ### Complain about a violation of a child's rights to NCPCR The National Commission for Protection of Child Rights (NCPCR) takes complaints about violations of child rights through its online system, e-Baal Nidan. The complainant's identity is kept confidential. **Keep this ready before you start:** - The child's age and school or platform name. - What happened, with dates. - Screenshots, letters and your earlier complaint to the school or company. 1. First write to the school principal or the company's grievance officer. Save the reply or ticket. 2. If it is serious or not fixed, open [NCPCR e-Baal Nidan](https://ncpcr.gov.in/ebaalnidan/). 3. Register or log in, then lodge a complaint. Describe what happened and attach proof. 4. Save the complaint number. You get updates by email or SMS. 5. Track it with **Track Complaint** using your registered email or mobile. 6. If a child faces sexual abuse or obscene content online, report it on cybercrime.gov.in or to the police at once. Checked on 1 November 2026 against: [NCPCR e-Baal Nidan: online complaints about child rights](https://ncpcr.gov.in/ebaalnidan/). ### Use your DPDP rights (from 13 May 2027) The rights in sections 11 to 14 of the DPDP Act, and the duties of companies that go with them, start on 13 May 2027 (G.S.R. 843(E)). Until then you can still write to a company and ask. Many will answer. But they are not yet bound by these sections. **Keep this ready before you start:** - The company's published method for rights requests. Rule 14 says companies must show it on their website or app. - The identifier they ask for, such as your username, customer ID or registered mobile number. 1. Find the company's rights or grievance page, or its Data Protection Officer contact. 2. Send a written request using the method they publish. Use our [request letter template](https://dpdpr.in/rights/rights-request-letter/). 3. Ask for what you need: a summary of your data and how it is used, and the names of everyone it was shared with (section 11); correction, completion, updating or erasure (section 12); or a fix for a grievance (section 13). You can also nominate someone to act for you after death or incapacity (section 14), and withdraw consent (section 6(4)). 4. Save the acknowledgement or ticket number. 5. Wait for the time they publish. Rule 14(3) says it cannot be more than 90 days. 6. If they refuse or do not answer, you can complain to the Data Protection Board of India. You must use the company's grievance route first (section 13(3)). 7. The Board works as a digital office. Use the method it publishes on its website and app (rule 19). We will add the link when the Board publishes it. Checked on 1 November 2026 against: [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf), [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). ## Ready-to-use complaint Copy, fill the brackets, and send it through the company's official channel. Keep a copy. To: Principal / Grievance Officer, \[school or company\] Subject: Use of my child's personal data, \[child's name\], class \[ \] Please tell me what data about my child you hold, who you shared it with (including any app or ed-tech company), and on what basis. Please stop \[sharing / marketing / posting photos\] and delete \[data\]. From 13 May 2027 section 9 of the DPDP Act requires verifiable parental consent for this. \[Parent's name\], \[mobile\], \[date\] ## Time limits - Spam complaint about ed-tech calls: within 7 days. - Consumer case: within 2 years. - DPDP rights: from 13 May 2027. ## If this happened to you - [\*\*My child's school app collects too much or shares my child's data\*\*A school or ed-tech app collects or shares more than it needs about your child.](https://dpdpr.in/rights/scenarios/school-app-children/) - [\*\*A company keeps sending marketing after I said stop\*\*Calls, SMS or emails continue after you opted out or registered DND.](https://dpdpr.in/rights/scenarios/marketing-after-opt-out/) - [\*\*After my exam, coaching institutes and admission agents started calling\*\*After a board or entrance exam, callers know your roll number, marks or rank.](https://dpdpr.in/rights/scenarios/coaching-calls-after-exam/) - [\*\*An ed-tech sales team pressured my family and seemed to know about my child\*\*Sales staff knew your child's class and school, and pushed a course or a loan.](https://dpdpr.in/rights/scenarios/edtech-sales-pressure/) - [\*\*My child's school posts photos and shares parent numbers\*\*The school puts children's photos online or shares parents' numbers in big groups.](https://dpdpr.in/rights/scenarios/school-posts-photos/) ## Official sources - [PIB, 23 December 2021: Ministry of Education advisory on ed-tech companies](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1784582) - [NCPCR e-Baal Nidan: online complaints about child rights](https://ncpcr.gov.in/ebaalnidan/) - [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf) - [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) - [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf) - [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)