Skin
Free gap analysis · EdTech

DPDP Gap Analysis for EdTech Companies

Measure your organisation’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to online learning platforms, tutoring applications, test preparation platforms, learning management systems, educational content providers and other Education Technology (EdTech) companies operating in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the organisation assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the organisation identified its responsibilities as a Data Fiduciary or Data Processor for student, parent, teacher and institutional data?
03 Are data protection responsibilities clearly defined across technology, product development, marketing, admissions, customer support and other relevant teams?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Personal Data Inventory and Mapping
05 Has the organisation identified the personal data it collects about students, parents, teachers, employees and other individuals?
06 Has the organisation documented the purposes for processing personal data, including registration, learning delivery, assessments, progress tracking, payments and marketing?
07 Has the organisation mapped how personal data flows between websites, mobile applications, learning management systems, cloud services and third-party platforms?
08 Does the organisation maintain an inventory of systems, databases and vendors that store or process personal data?
09 Has the organisation identified personal data shared with educational institutions, tutors, payment providers, analytics services, advertising platforms and other recipients?
3. Privacy Notices and Consent
10 Does the organisation provide clear privacy notices explaining what personal data is processed, why it is processed and how individuals can exercise their rights?
11 Has the organisation identified which processing activities require consent and which qualify as certain legitimate uses permitted under the DPDP Act?
12 Where consent is required, does the organisation obtain and maintain records of valid, purpose-specific consent?
13 Can users withdraw consent through accessible channels, and does the organisation stop the relevant processing unless another legal basis permits or requires its continuation?
14 Are appropriate privacy notices and consent mechanisms implemented across websites, mobile applications, registration forms and other user channels?
4. Children’s Personal Data
15 Does the organisation have a process to identify users below 18 years of age, where relevant to its services?
16 Does the organisation obtain verifiable parental consent before processing children’s personal data, where required under the DPDP Act and Rules?
17 Does the organisation have safeguards to prevent prohibited tracking, behavioural monitoring and targeted advertising directed at children, subject to applicable exemptions?
18 Does the organisation ensure that its processing of children’s personal data does not have a detrimental effect on their well-being?
19 Does the organisation have procedures for handling parental consent, consent withdrawal and applicable data protection requests involving children?
5. Data Principal Rights and Retention
20 Can individuals exercise their applicable rights to access information about their personal data, request corrections or updates, and request erasure?
21 Does the organisation have documented procedures for verifying, tracking and responding to Data Principal requests and grievances?
22 Has the organisation defined retention periods for student profiles, learning records, assessment results, recordings, payment information and other personal data?
23 Does the organisation erase personal data when it is no longer required and no applicable law requires its retention?
24 Can the organisation implement and verify personal data deletion across relevant systems and third-party Data Processors?
6. Data Security and Breach Management
25 Has the organisation implemented appropriate technical and organisational security safeguards to protect personal data?
26 Are access to student records, assessment results, recordings and other personal data appropriately restricted, monitored and logged?
27 Does the organisation have documented procedures to detect, investigate, respond to and record personal data breaches?
28 Can the organisation notify affected individuals and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, AI and Cross-Border Processing
29 Does the organisation assess the data protection practices of third-party providers, including cloud hosting, learning tools, analytics, payment processing and marketing services?
30 Do contracts with Data Processors include appropriate provisions for data protection, security, breach reporting and deletion?
31 Has the organisation assessed privacy risks associated with Artificial Intelligence (AI), personalised learning, automated assessments, student profiling and learning analytics?
32 Has the organisation identified personal data processed or accessed outside India and assessed applicable DPDP restrictions?
8. Training and Compliance Monitoring
33 Are employees, tutors, instructors and relevant support personnel trained on their responsibilities under the DPDP Act?
34 Does the organisation assess privacy risks before launching new learning products, applications or significant changes to personal data processing, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the organisation periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.