DPDP for Schools and Educational Institutions

Can my school track my child's GPS?

There are two narrow routes, and both are narrower than they look. One covers a transport provider the school has engaged, tracking your child's location for her safety, on the way to and from school. The other covers working out a child's live location where the tracking is limited to her safety, protection or security, and that one is not tied to the school run.

Neither is a permission to track. They only remove the need to ask you first. The school still needs a proper reason to be tracking at all, and neither route covers tracking for something unrelated, or keeping the location history once the safety reason has passed.

ACT · Sections 4, 9(1) and 9(3); RULES · Fourth Schedule Part A item 5, and Part B item 4.

Can my school monitor or track my child's behaviour?

Yes, but only for two things: the school's own educational activities, or your child's safety. Anything else falls outside it.

RULES · Fourth Schedule Part A, item 3.

Does the school need my consent to process my child's data?

Yes, as the starting point. A school has to get a parent's verifiable consent before handling a child's information at all.

The Rules then lift that requirement for a short list of situations, and the school one is narrow: tracking and monitoring, for the school's educational activities or for the safety of enrolled children. The same list covers a few other things, such as working out a child's real-time location for her safety, keeping harmful content away from her, and checking whether a user is a child in the first place.

Outside that list, a parent's verifiable consent is still required. This is worth being clear about, because the ordinary situations where an adult would not have to be asked do not lift the children's rule. It is lifted only by that list.

ACT + RULES · Section 9(1); Fourth Schedule Part A, item 3.

Can the school use student data to advertise to my child?

No. Advertising aimed at children is banned outright, and so is tracking or behavioural monitoring of children outside the narrow school allowance. The school's exception covers educational activities and safety. Advertising is neither, whatever the advertisement is for.

ACT + RULES · Section 9(3); Fourth Schedule Part A, item 3.

Can the school share student data with an edtech app or online test platform?

Only with a proper reason for that particular sharing. The school's exemption for children's data is limited to tracking and monitoring for educational activities and safety, so handing information to an outside platform either has to fit inside the Rules' short list of exempt situations, or it needs your verifiable consent.

If the platform is running the service on the school's behalf, rather than for its own ends, the school also has to have a proper contract with it before anything moves.

ACT + RULES · Sections 8(2) and 9; Fourth Schedule Part A, item 3.

Can the school keep old student records after the child leaves?

Only while there is still a live reason, or while another law requires it. Once your child has left and no legal duty applies, the records should be deleted rather than kept indefinitely.

ACT · Section 8(7).

Does the school need fresh parental consent every year?

There is no automatic yearly renewal. What you agreed to stays valid for that purpose until you withdraw it or the purpose is finished.

If the school starts doing something materially new with the data, that is a new purpose, and it has to be asked for again.

ACT · Sections 6 and 8(7).

Can the school put my child's photo on Instagram or in the brochure?

Not on the strength of the admission form. The school's exception for children's data covers watching and monitoring for its own educational activities, or for your child's safety. Publicity is neither of those.

So publishing your child's picture needs a parent's verifiable consent, asked for specifically, and you can say no to it without that affecting anything else the school does.

There is also a line the school cannot cross whatever anyone agrees to: advertising aimed at children is barred outright.

ACT · Sections 9(1) and 9(3); RULES · Fourth Schedule Part A, item 3.

Can the school refuse admission because I did not agree to everything on the form?

A school can insist on what it genuinely needs in order to educate your child and look after her. That part is not really a choice for either of you.

What it cannot do is bundle. Agreement has to be specific, and limited to the information the stated purpose actually needs. One tick covering the school's own records, plus a partner app, plus promotional use, is not one agreement. It is several, and only the necessary part stands.

Anything in a consent form that signs away a right the law gives you is invalid on its own terms, whether or not you signed it.

ACT · Sections 6(1), 6(2) and 9(1).

The school app asks for contacts, camera and location. Is that allowed?

Only for what the app genuinely needs to do the job it was given. Agreement is limited to the information the stated purpose actually requires, and the Act makes the point with its own example: an app that asks both to provide its service and for your contact list gets agreement for the service only, because the contact list was never necessary for it.

Applied to a school app, a permission that the app does not need for what it is actually for does not become allowed just because the form asked and somebody tapped yes.

ACT · Section 6(1) and its Illustration; Section 9(1).

You signed the admission form, so we can use your child's data however we need to.

Agreement has to be specific to a stated purpose, and limited to the information that purpose actually needs. An admission form covers admission and education. It does not cover selling the class list, sponsor promotions, or an app the school signs up to two years later. And if the school says you agreed, it is the school that has to prove it, not you who has to disprove it.

The law gives schools an exemption, so we can use children's data as we see fit.

It exempts one narrow thing for schools: tracking and behavioural monitoring, and only for the school's educational activities or the safety of enrolled children. The same list covers a few other situations, such as working out a child's real-time location for her safety and checking whether a user is a child at all. Outside that list, a parent's verifiable consent is still required, and the ordinary situations where an adult would not have to be asked do not lift the children's rule.

We can pass student details to our partner coaching centre or edtech app.

That is a new purpose and it needs a reason of its own. If the partner is handling the data on the school's behalf, rather than for its own ends, the school also has to have a proper contract in place before anything moves.

Showing your child ads is fine because the content is educational.

Advertising aimed at children is barred outright. Nothing in the exemptions brings it back, whatever the advertisement is for.