Edtech Privacy: Student Profiles, Parent Data and Learning Analytics
An edtech privacy framework for student accounts, parental verification, learning analytics, proctoring, teacher access, advertising, safety and deletion.
Student engagement data can improve learning, but it can also become a permanent behavioural profile used outside education.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
The Act defines a child as a person below eighteen and contains specific child-data duties and restrictions, subject to phased commencement and notified exemptions.
Student, parent and teacher data should be separated because each person has different purposes and controls.
Proctoring, emotion detection, attention scoring and behavioural analytics require necessity, accuracy and harm review.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
- The Act defines a child as a person below eighteen and contains specific child-data duties and restrictions, subject to phased commencement and notified exemptions.
- Student, parent and teacher data should be separated because each person has different purposes and controls.
- Proctoring, emotion detection, attention scoring and behavioural analytics require necessity, accuracy and harm review.
- Advertising or unrelated product promotion should not be hidden inside learning analytics.
The five-point review
| Check | What to examine |
|---|---|
| User | Child, parent, teacher or adult learner. |
| Data | Identity, performance, behaviour, device and video. |
| Purpose | Teaching, assessment, safety, support or marketing. |
| Access | Teacher, school, parent, vendor and administrator. |
| End | Course completion, school exit and deletion. |
Practical example
An app retains webcam recordings and attention scores after the exam and later uses them to rank students for unrelated courses. That new purpose needs separate scrutiny and may create child-data risk.
How to apply the framework
Design child and adult journeys separately. Verify parental involvement proportionately without creating unnecessary identity stores.
Give schools and parents clear controls over class rosters, exports, teacher access and end-of-term deletion.
Operating workflow
Define the real process before selecting the legal label
Identify the people, data, systems, purpose, owner, processor, user journey and failure scenario. Review user, data and purpose together. A policy statement or vendor assurance cannot replace evidence of how the live product behaves.
Separate current obligations from scheduled DPDP controls
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative CERT-In, banking, telecom, insurance, employment, consumer, contract and criminal-law requirements. Build the scheduled DPDP workflow now, but do not describe a future provision as already enforceable.
Test and preserve evidence
Run the workflow in the live or controlled test environment. Preserve screenshots, approvals, logs, vendor responses, user communications, exceptions and remediation. Assign a named owner and completion date to every failed control so management can distinguish an operating safeguard from a policy intention.
Action checklist
- Classify users and age.
- Map learning and monitoring data.
- Build parental workflows.
- Review analytics and proctoring.
- Restrict advertising.
- Set course and school exit controls.
Evidence to keep
- Age and audience assessment
- Parent workflow
- School and vendor contracts
- Analytics model documentation
- Deletion and export records
Warning signs
- Adult flow used for children
- Behavioural ads
- Webcam retention without purpose
- Teacher downloads entire school
- Student profile follows unrelated products
Finin2min takeaway
Privacy and cyber maturity are visible in operating behaviour: what the organisation collects, who can use it, how vendors are controlled, how users exercise choices, how incidents are handled and whether evidence survives scrutiny.