Student Data Privacy in AI: What Indian Schools Must Demand

Key takeaways

Under the DPDP Act, every student under 18 is a child, with extra protections.
The school is usually the Data Fiduciary and stays accountable.
Ask vendors eight questions in writing and keep the answers.
Insist on a signed Data Processing Agreement before any accounts are created.
A vendor that will not answer plainly is not ready for your students.

What does the DPDP Act require for children's data?

India's Digital Personal Data Protection Act, 2023 (DPDP Act) is the country's main data protection law. It treats anyone under 18 as a child, which covers almost every school student. Section 9 adds specific protections for children on top of the general rules:

Verifiable consent from a parent or lawful guardian before a child's personal data is processed.
No processing that is likely to cause a detrimental effect on a child's well-being.
No tracking, behavioural monitoring or targeted advertising directed at children.

“Verifiable” matters. A child ticking a box is not parental consent. The DPDP Rules, notified in November 2025 and being phased in, describe how consent can be verified and set out limited exemptions, including some for educational institutions for specific purposes. Exemptions are narrow; take legal advice before relying on one.

The Act also gives individuals, and parents on behalf of children, rights to information about their data, correction and erasure, and to grievance redress. Complaints can ultimately go to the Data Protection Board of India, which can impose significant financial penalties.

Who is responsible: the school or the vendor?

In most school deployments, the school is the Data Fiduciary: it decides why students use the tool and what data is involved. The AI company is a Data Processoracting on the school's behalf under a contract. The Act places responsibility for compliance on the Data Fiduciary, including for processing done by its processors. In plain terms, “the vendor said it was compliant” is not a defence. The school must check.

What eight questions should every school ask an AI vendor?

Ask these in writing, keep the written answers on file, and do it before signing anything. A vendor that cannot answer clearly is not ready for deployment.

DPDP duties and a signed DPA. How do you meet India's DPDP Act for children's data, specifically Section 9? Will you sign a Data Processing Agreement before any student account is created?
Where data is processed. Where exactly is student data stored and processed, including by any AI provider? If any of it leaves India, which countries and under what safeguards?
Model training. Is student data, or anything sent to a third-party AI model, used to train or improve AI models? Will you commit to that in the contract?
Retention and deletion. How long is each type of data kept? What happens to all student data when the contract ends, how quickly is it deleted, and how is deletion confirmed in writing?
Parental consent. How is parental consent obtained and verified? Can we see the consent flow? How do you make sure the person consenting is the parent and not the child?
Parents' rights. How can a parent see what is held about their child, correct it, or ask for it to be deleted mid-year? How quickly do you respond?
Sub-processors. Which third parties (hosting, AI models, email, analytics) process student data? Are they named in the DPA, and are they bound by equivalent obligations?
Breaches. If student data is exposed, how quickly will you tell the school, and how will affected families and authorities be informed?

What should a Data Processing Agreement include?

A Data Processing Agreement (DPA) is not a privacy policy or terms of service. It is a contract governing how the vendor processes personal data on the school's behalf. At a minimum, a DPA for a school AI tool should set out:

The categories of student data processed and the purposes allowed.
A commitment to process data only on the school's documented instructions.
How the vendor supports the school's duties under the DPDP Act, including Section 9.
Where data is stored and processed, and controls on transfers outside India.
A named list of sub-processors and how changes are notified.
Security measures, and how and when breaches are reported to the school.
How parents' access, correction and deletion requests are handled, and how fast.
Retention periods, and deletion or return of data at the end of the contract, with written confirmation.

Breach reporting deserves attention. Under the DPDP Rules, affected people and the Data Protection Board must be informed of personal data breaches, and CERT-In's 2022 directions require many organisations to report certain cyber incidents within six hours. Your DPA should make sure the vendor tells you quickly enough for you to meet your own duties.

What are the red flags?

A privacy policy offered in place of a DPA.
“Fully DPDP compliant” with no detail on how.
Vague answers on where data is processed or which AI provider is used.
No clear retention periods, or “we keep data to improve our services”.
Consent collected from the child, not the parent.
No written plan for deleting data if the company is sold or closes.

That last point is not theoretical. EdTech businesses fail, merge and change owners; BYJU's, once India's most visible EdTech brand, entered insolvency proceedings in 2024. A deletion clause that applies on termination, insolvency or change of control protects your students if the company you choose does not last.

How does Kyloen answer these questions?

We think vendors should publish their answers, so here are ours. Chats are processed by a US-based AI provider under contract, which we disclose on our How AI Works page; we do not claim that data stays in India. Children's data is not used to train AI models, and there is no advertising. Raw chat messages are deleted after 90 days; some derived information, such as interests, is kept while the account is active, and safety alerts are retained for legal reasons. A parent sets up the account, and we are strengthening that step to meet the DPDP standard of verifiable parental consent.

Schools can read our template school DPA before talking to us, and our full privacy policy names our grievance contact. Hold us to the same eight questions as anyone else.

Frequently Asked Questions

What does India's DPDP Act require for children's data?

The Digital Personal Data Protection Act, 2023 treats anyone under 18 as a child. Section 9 requires verifiable consent from a parent or guardian before a child's personal data is processed, prohibits processing likely to harm a child's well-being, and prohibits tracking, behavioural monitoring and targeted advertising directed at children, subject to limited exemptions in the Rules. The Rules were notified in November 2025 and are being phased in.

Who is responsible for student data when a school uses an AI tool?

Usually the school. In DPDP terms the school is typically the Data Fiduciary, which decides why and how students' data is used, and the AI vendor is a Data Processor acting on its instructions under a contract. The school remains accountable for compliance, so it must check the vendor's practices rather than rely on marketing claims.

What is a Data Processing Agreement and why does a school need one?

A Data Processing Agreement (DPA) is a contract that sets out exactly what student data the vendor processes, for what purposes, where, how it is secured, which sub-processors are involved, how breaches are reported, and how data is returned or deleted. It is how a school turns a vendor's promises into enforceable obligations.

Do AI companies use student data to train their models?

Some do and some do not, and some rely on third-party AI providers with their own terms. Ask in writing whether student data, or data sent to any AI provider, is used to train or improve models, and get a contractual commitment rather than a reference to general terms of service.

Can student data be processed outside India?

The DPDP Act allows personal data to be transferred outside India except to countries the government restricts by notification. Many AI services process data abroad. Schools should ask where data is processed, by whom and under what safeguards, and should be wary of vendors who will not say.

This article is general information, not legal advice. Schools should take advice from a qualified lawyer on their specific obligations.

For Schools

AI for Schools in India: What Administrators and Teachers Need to Know

For Schools

How Indian Schools Can Implement AI Companions Responsibly

AI Safety

Is AI Safe for Children? What Indian Parents Need to Know