DPDP for Tutors & Coaching Classes, Explained

At a glance

A tutor or coaching class handles the same regulated thing a big edtech platform does — minors’ personal data — at kitchen-table scale: admission registers, parent phone numbers, batch WhatsApp groups, topper photos on the wall and the Instagram page. India’s DPDP Act applies in full; there’s no small-operator exemption, and the institutional relief the Rules give schools shouldn’t be assumed to cover a private coaching centre. The good news: at this scale, compliance is five habits — parental consent, minimal collection, controlled groups, results published only with permission, old batches deleted.

Educational resource only. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to tutors and coaching classes; it is not formal legal advice.

The situation

Coaching runs on relationships and reputation: the parent’s number saved from the first enquiry, the batch group where homework and marks flow daily, the topper’s photo and score on the banner because that’s how the next batch signs up. None of it feels like “data processing” — it feels like running a class. The DPDP Act sees a business processing minors’ personal data, at whatever scale, and the habits that feel most natural — the group, the banner, the enquiry list worked for years — are precisely where the law and the practice diverge.

Does DPDP really apply to a single tutor?

Yes — a home tutor with one register is a Data Fiduciary the moment they decide how students’ and parents’ data is used; scale never switches the Act off. The duties are the standard set: tell people what you collect and why, have a lawful basis, keep it secure, don’t hoard it past its purpose. For most coaching practices the data is modest — names, classes, parents’ contacts, fees, marks — which makes the duties genuinely light. What raises the stakes is whose data it is: students under 18 bring the children’s-data regime (Section 9), and that’s not scaled to headcount either. A fifty-student tuition centre carries the same parental-consent logic as a fifty-lakh-user app — just with far simpler ways to meet it.

The data a coaching practice actually holds

Small in volume, sensitive in kind — minors’ details, family contacts, and performance records.

• Enrolment basics — student names, ages, schools, classes; parents’ names and phone numbers; addresses for home tuition.
• Academic data — test scores, rankings, progress notes, weak-subject assessments: a minor’s performance profile.
• Fee records — payment histories, sometimes parents’ bank or UPI details; dues lists.
• The communication layer — batch WhatsApp groups holding names, numbers, marks and photos of minors, visible to every member.
• The marketing assets — topper photos, scores and names on banners, pamphlets and social pages; testimonial videos of students.
• The enquiry list — years of prospective parents’ numbers from demos and walk-ins, worked for every new batch.

The obligation that actually bites: minors’ data at solo scale

Your students are children in the Act’s eyes — their data needs a parent’s consent, and their performance isn’t yours to broadcast. The children’s regime translates directly at this scale:

1. Enrol through the parent. For under-18 students, processing runs on parental consent — which coaching practices are naturally positioned for, since the parent usually enrols and pays anyway. Make it explicit: a short admission form the parent signs, saying what’s collected and what it’s used for. That signature, kept, is your consent record.
2. Marks are the child’s data. Publishing scores and rankings to the whole batch group, or posting a student’s result on the banner and Instagram page, is disclosure of a minor’s personal data — genuinely fine with the parent’s specific permission, and a violation without it. Ask per student, per use; most proud parents say yes, which is exactly why asking costs nothing.
3. Photos and videos follow the same rule. Classroom photos in marketing, testimonial reels, annual-function albums: a minor’s image needs the parent’s permission before it becomes your content.
4. No behavioural games with minors’ data. Coaching rarely runs tracking tech, but the same restriction reaches low-tech forms — public shaming boards of “weak students,” or pressure marketing built on a child’s performance data aimed at the family, sit against both the tracking-and-targeting restrictions’ spirit and the trust the business runs on.

Don’t assume the schools’ relief covers you

The Rules give scoped relief to educational institutions — a private coaching centre shouldn’t build on the assumption it’s one of them. The Fourth Schedule’s concessions (relief from consent formalities for educational activities and safety monitoring) attach to institutional classes like schools; whether a commercial coaching centre qualifies is at best unsettled, and the safe posture is to run on parental consent — which, at coaching scale, is barely a burden: the parent is already at the desk, form in hand. Beyond the children’s layer, no sectoral regulator reaches coaching at all — no board, no council — so like the immigration trade, the DPDP Act is the first general law that touches the practice’s data habits, and visible discipline (a real admission form, a controlled group, permission-based marketing) doubles as differentiation in a market parents choose on trust.

Common mistakes coaching classes make

Reputation habits, unexamined.

• The all-batch group — every student’s marks, photos and numbers visible to every parent in one WhatsApp group; disclosure as a daily routine.
• The results banner without asking — toppers’ names, photos and scores as marketing, permission never sought.
• The immortal enquiry list — every demo attendee’s number since the centre opened, messaged before every batch, no consent trail.
• Registers and phones as the database — student data on the tutor’s personal phone and a desk register anyone can flip through.
• Fee-dues shaming — dues lists read out or posted to the group: financial data of a family, broadcast.
• Old batches never deleted — a decade of ex-students’ records and numbers, kept for no purpose beyond habit.

Running admissions and batches compliantly

One signed form at admission, one controlled group discipline, one ask before any marketing use — the whole fix fits on a page. The admission form does the legal work: what’s collected, what it’s used for (teaching, progress updates, fees), the parent’s signature as consent, and two separate tick-boxes — one for publishing results/photos in marketing, one for future-batch messages. Batch groups carry schedules and materials; individual marks go to the individual parent. The enquiry list gets a consent habit (“may we message you about the next batch?”) and an annual cleanup. And when a batch passes out, the records that have no purpose left — most of them — get deleted. The consent-form pattern in this site’s templates section translates directly to a coaching admission form; a tutor who runs it is more compliant than most edtech apps.

FAQ