Home/Industries/Education
Education door · DPDP Rule 11 + UGC + AICTE + NAAC

Parental consent, NAAC-ready, one platform.

Every K-12 school and EdTech sign-up is a minor under DPDP. Rule 11 demands verifiable parental consent — not a checkbox. dcomply ships Aadhaar e-KYC, DigiLocker, card micro-charge and in-person KYC paths, a student+parent DSR portal, NAAC + UGC + AICTE trackers, and POSH + Labour for the staff side.

one DSR fans out to LMS · SIS · LinkedIn Learning
RULE 11 · PARENTAL CONSENT DECISION TREE
REV. 2026.10

Six frameworks, one roll.

DPDP Rule 11 for the minor. UGC / AICTE / NAAC for the institution. POSH + Labour for the staff. All on one calendar with one evidence base.

DPDP Rule 11 (minors) Verifiable parental consent for anyone under 18. Four verification paths supported.
DPDP Act 2023 + Rules 2025 Student + parent DSR portal, breach, retention, policy generation.
UGC regulations Approvals, filings, Regulatory Alignment pulls notifications as they drop.
AICTE approvals Programme approvals, faculty records, student-faculty ratio tracking.
NAAC accreditation Full cycle: IEQA → SSR → peer visit. 5-year evidence window.
POSH + Labour Codes IC constitution, awareness training, PF/ESIC, staff register.

Four fires that cost the accreditation.

01

Rule 11 verifiable parental consent. Under-18 = minor. Checkbox self-declaration is invalid. Need Aadhaar e-KYC, DigiLocker, verified card micro-charge or in-person KYC. All four supported.

02

Student data for AI training. Only with explicit purpose-scoped consent from parent (minor) or student (18+). "Improve our services" is too broad under DPDP. Separate purpose chips: personalisation, model training, third-party research.

03

NAAC + UGC + AICTE cycle. Each has its own evidence window and cadence. SSR, IEQA, peer-visit, UGC filings, AICTE approvals. One rolling evidence base keeps all four fresh.

04

POSH IC at coaching institutes. 10+ employees = mandatory IC. Annual return by 31 December. Awareness training logged. Templates ready.

Every education module, campus-aware.

Single-campus engagement from Rs 1,99,999 (60 days). Multi-campus (custom quote). Managed retainer from Rs 19,999/mo.

Education compliance in four numbers.

Under 18
Rule 11 verifiable parental consent trigger
90 d
DSR response SLA (Rule 14)
31 Dec
POSH annual return deadline
5 yrs
NAAC evidence window per cycle

Questions principals and EdTech leads actually ask.

Q 01
What DPDP rules apply to EdTech and schools?

Any platform processing student data is under DPDP. Because students under 18 are minors, Rule 11 verifiable parental consent applies to the entire user base of a school or K-12 EdTech. Beyond DPDP: NCPCR guidelines, POSH obligations for staff, and GDPR/COPPA if content is sold cross-border.

Q 02
What is verifiable parental consent under DPDP Rule 11?

Rule 11 requires EdTech to obtain parental consent that is verifiable, not a self-declaration checkbox. Acceptable methods include Aadhaar-based e-KYC of the parent, DigiLocker verification, credit-card mini-transaction, or in-person KYC. dcomply supports all four with configurable per-tenant flows.

Q 03
Can I use student data for AI model training?

Only with explicit purpose-scoped consent from the parent (for minors) or the student (if 18+). Consent for "improving our services" is invalid under DPDP because it is not specific enough. dcomply's consent widget supports separate purposes for personalisation, model training and third-party research.

Q 04
Do coaching institutes need to appoint a DPO?

A DPO is mandatory only for Significant Data Fiduciaries. Very large EdTech platforms may be designated SDFs by the DPB. Coaching institutes below that threshold do not require a formal DPO but must still comply with all DPDP obligations. dcomply's virtual DPO service is a cost-effective option.

Q 05
How should schools handle DSR requests for student records?

A student DSR (or parental DSR for a minor) must be honoured within 90 days under Rule 14. dcomply's DSR portal captures the request, verifies the requester via OTP or in-person visit, fans it out to every connected source (LMS, SIS, LinkedIn Learning) via the discovery engine, and produces the export or erasure evidence.

Q 06
What POSH obligations does a coaching institute have?

The POSH Act 2013 applies to any workplace with 10 or more employees. Requirements: constitute an Internal Committee, conduct annual training, file annual return by 31 December, display policy prominently, and honour 90-day complaint resolution timelines. dcomply's POSH module handles all of this.

Q 07
How is children's consent verified under Rule 11?

The Rule 11 module supports multiple verification paths: parental Aadhaar (where legally used), verified phone/email, government-issued ID. dcomply keeps the audit trail.

Q 08
What about anonymised research data?

Anonymisation workflows are logged and the module maintains the boundary between identifiable and de-identified data.

Q 09
Do you handle multi-campus institutions?

Yes. Multi-tenant workspace with campus-level segmentation and roll-up reporting.

Q 10
What NAAC cycle timelines does it enforce?

Full NAAC cycle from IEQA to SSR to peer team visit, with the standard 5-year evidence window.

Q 11
Is UGC's new regulation covered?

New UGC regulations are added as they're notified. The Regulatory Alignment module tracks and applies them.

Request a scope. Ship Rule 11 consent in a week.

Single-campus engagement from Rs 1,99,999 (60 days). Multi-campus custom-quoted. Managed retainer from Rs 19,999/mo.