With India’s new Digital Personal Data Protection Act (DPDPA), 2023 now in force, parents have stronger legal rights — and greater responsibility — to protect their children’s personal data in the digital age and clandestine surveillance

Nagaraj

Every time your child logs into her school portal, a learning app, an online class, attends a virtual birthday party, or signs into a social media account (Facebook, Instagram, etc), her personal data is being collected and recorded. But how safe is this data? Who collects it, where is it stored, and what if it falls into the wrong hands?

With India’s new Digital Personal Data Protection Act (DPDPA), 2023 now in force, parents have stronger legal rights — and greater responsibility — to protect their children’s data in the new digital age and clandestine surveillance. It’s important for parents to understand these rights and follow simple cyber hygiene practices to keep children safe in the real and virtual worlds.

What is DPDPA?

Enacted in 2023 by Parliament, the Digital Personal Data Protection Act (DPDPA) is India’s first full-fledged law to protect personal data of individuals — including children. It applies to all digital data collected by websites, apps, schools, businesses, and government bodies.

The law defines children as anyone under 18 years and provides their data extra protection. Schools and companies are required by the Act to:

• Get verifiable parental consent before collecting children’s data
• Avoid tracking, profiling, or targeting children with ads
• Protect data with adequate security measures
• Allow parents to access, correct, or delete their child’s information
• If schools/companies/online service providers don’t comply, they face heavy penalties — up to Rs.250 crore.

But the law isn’t enough. Parents have a crucial role to play in protecting children’s data at home, on phones, and in school.

type of data being collected

Most parents will be surprised to learn just how much data is being collected — often without their knowledge. For instance:

• Name, age, and address during school admission inquiries or online school app signups
• Photos and videos posted online or stored on school websites/portals
• Location data history on mobile devices
• Browsing history tracked by apps and online games
• Health and academic records stored digitally
• Biometric data (such as fingerprints or face scans) collected by some schools

This data, if misused or leaked, can result in identity theft, cyberbullying, fraud, and stalking.

How parents can protect their child’s data

Here are some legal and practical ways parents can protect children’s personal data:

Understand where and why data is being collected. Before signing up for any school app, education platform, or online game, ask these questions of the service provider:

• What data is being collected?
• Why is it needed?
• Will it be shared with third parties?
• How long will it be stored?

Insist on reading the privacy policy and ensure there’s a way to delete the account or data later.

Provide informed parental consent. Under the DPDPA, parental consent must be verifiable and informed — not assumed. Don’t tick all the boxes blindly during sign-ups. Choose only what’s necessary, and revoke consent if you no longer want your child’s data to be used.

Follow basic cyber hygiene. Start with the basics:

• Use strong passwords and don’t reuse them
• Teach your children not to share personal details (such as home address or school name) online
• Turn off location sharing unless needed
• Avoid providing unnecessary permission to apps (such as access to microphone and contacts)
• Regularly update software and antivirus programs on mobile phones/laptops

Monitor children’s digital devices without micromanaging. Don’t overly rely on digital parental controls. Encourage open discussions with children on the risks of oversharing personal information, privacy settings, and ways to identify suspicious behavior online. Encourage children to report cyber bullying or privacy breaches without fear.

Watch out for fake profiles and impersonation. Monitor whether your child’s name or photos are being used on fake social media accounts or suspicious websites. Use Google reverse image search to detect unauthorised usage of your child’s photos.

If there’s misuse, report it to the online platform immediately and lodge a complaint with the Data Protection Board established under DPDPA.

Ask your child’s school about its data practices. Under the DPDPA schools are now legally required to protect student data. As a parent, you are entitled to:

• Request a copy of the school’s data privacy policy
• Solicit information on how your child’s attendance, grades, and photos are stored and shared
• Check if the school’s biometric systems or online platforms have proper safeguards
• Insist and ensure that the school is not sharing your child’s data with third-party vendors without your consent

What rights do parents have under DPDPA?

As a legal guardian, you have the right to:

• Access your child’s personal data collected and stored by any app, platform, school/ education institution
• Request correction or deletion of data that’s inaccurate or no longer needed
• Withdraw consent at any time
• File a complaint with the Data Protection Board of India if your child’s rights are violated for investigation and penalties.

Offline world matters too

It’s not just the internet — personal data can also leak offline. Here are some offline habits worth changing:

• Avoid writing your child’s full name, age, school on school bags, bottles, uniforms
• Don’t share admission forms, ID cards, school circulars on WhatsApp groups or Facebook
• Be cautious while filling out surveys or contests that ask for detailed family data
• Shred physical copies of previous years’ school report cards, doctor prescriptions, etc before discarding

Protecting your child’s data is about more than avoiding identity theft and cyber fraud/bullying. It’s about preserving their dignity, security, and freedom in an increasingly data-driven world.

(Nagaraj B.S. is a Bengaluru-based legal advisor, IP, tech and data privacy lawyer)

Also Read: You First, Parenting Second: Importance of Self-Care