🧠 Food for thought

Implications, context, and why it matters.

DPDP rules raise hurdles for school‑aligned tutoring

• Uprio partners with 57 schools in Bengaluru and Delhi for Central Board of Secondary Education (CBSE) grades 5–9. India’s Digital Personal Data Protection Act (DPDP) treats anyone under 18 as a child and requires verifiable parental consent. 12
• AI finds learning gaps and tracks progress, so the system collects academic and behavioral data. The DPDP Act bans tracking, behavioral monitoring, or targeted ads to children, so providers must adapt. 21
• GDPR in the European Union allows consent from ages 13–16, while India sets an under‑18 rule that needs verifiable parental consent. Providers use age checks and one‑time password (OTP) guardian consent tied to government IDs, which slows onboarding for grades 5–9 subscriptions. 21

A new layer for school‑edtech compliance

• School alignments raise needs for consent management, child‑safe handling, and clear privacy notices. Gaps in governance and capacity in India’s edtech market drive demand for business‑to‑business (B2B) tools with verifiable parental consent, age checks, audit trails for schools plus vendors. 3
• Investors can track startups building privacy‑preserving age checks using European zero‑knowledge proof pilots (a cryptography method that proves an attribute, like age, without revealing identity data). 4
• Auditors for edtech and accreditation services will matter more. The DPDP Act requires periodic audits for Significant Data Fiduciaries (large or high‑risk data handlers designated by the government) and recommends Data Protection Impact Assessments (DPIAs) for child‑focused services. Penalties can reach ₹200 crore, which boosts demand for vetted vendors. 526