The exemption follows the purpose,not the product.

A school tracking attendance is exempt for that purpose. The app it uses is not exempt for everything else.

In one line: No. The Rules exempt certain processing of children's data by educational institutions for specified purposes, such as educational activities and safety, from some Section 9 requirements. Other obligations continue to apply.

The estate · EdTech & children's dataHover to inspect

The school's exemption does not travel with the vendor's pitch deck.

The scene

The vendor's sales deck said ‘DPDPA exempt for schools’. The school believed it. The app tracked attendance, which the Rules contemplate. It also profiled students for a scholarship marketplace, which they do not.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Schools are exempt from DPDPA. Exemptions in the Rules cover specified processing for specified purposes, not all processing. Read the exemption as a list, not a label.
The vendor is covered by the school's exemption. The vendor processes for the school; anything it does for itself needs its own basis. Contract the vendor to the school's purpose only.

What remains

Even where an exemption applies to parts of Section 9, security safeguards, breach intimation and purpose limitation continue to apply.

Monday morning

  1. 01List the purposes for which you rely on an exemption.
  2. 02Check each against the text of the Rules.
  3. 03Remove vendor features that fall outside it.

Questions, answered plainly

Are schools exempt from DPDPA?

No. The Rules exempt certain processing of children's data by educational institutions for specified purposes, such as educational activities and safety, from some Section 9 requirements. Other obligations continue to apply.

Do EdTech vendors benefit from a school's exemption?

Only to the extent they process data for the school's exempt purpose on its behalf. Processing for the vendor's own purposes needs its own lawful basis.

Sector · EdTechA child's data is not a cookie. Stop treating it like one.Read → EdTech & children's data · Deep diveA tick from a twelve-year-old is not a parent's consent.Read → EdTech & children's data · Deep divePersonalisation is monitoring with a better name.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner