शिक्षा संस्थानों पर DPDP अधिनियम का दायित्व, APAAR सहमति अब ‘बॉक्स‑टिकिंग’ नहीं

Summary: The blog provides a summary of the Supreme Court’s recent judgment in Abhishek Baxi v. Union of India, where parents challenged the extensive and compulsory nature of collecting and retaining student information for the purpose of generation of Automated Permanent Academic Account Registry (“APAAR”) ID. Among other findings, the Supreme Court emphasised that consent must be meaningful and informed. It also acknowledged the need for data protection at the time of collection and processing data, in light of the Digital Personal Data Protection (“DPDP”) laws, reinforcing the need for educational institutions to ensure compliance.

Educational institutions are custodians of personal data in today’s time. They collect much of this data, such as name, phone number, health information, parent’s financial information, etc., at the time of admission or onboarding through standard forms and processes. Yet misperception persists that data protection laws do not, or would not, apply to charitable institutions. However, with the DPDP Act, 2023 (“DPDPA”), coming into full force on May 13, 2027, educational institutions are required to secure compliance with this law as well.

This has also been brought into light by the Supreme Court in its recent order dated July 20, 2026, in Abhishek Baxi and Ors. v. Union of India and Ors[1] (“Abhishek Baxi case”), where it underscores that educational institutions cannot treat consent for data collection merely as a box-ticking exercise.

APAAR Before the Supreme Court

In the Abhishek Baxi case, parents of children of CBSE-affiliated schools filed a Public Interest Litigation before the Supreme Court challenging the consent mechanism adopted by schools under the (“APAAR”) Scheme. A Ministry of Education’s “One Nation, One Student ID” initiative under the National Education Policy, 2020, this scheme assigns every student a unique, Aadhaar-linked digital academic identifier intended to ensure continuity of records, facilitate inter-institutional transfers, and enable credit mobility. While the Ministry of Education’s circular dated October 11, 2023 made parental consent a prerequisite for generating such APAAR ID, the consent form template issued with the circular neither provided students’ parents with the option to decline consent nor did it clearly disclose the purpose, scope, retention period, or data-sharing practices relating to the information collected.[2]

The petitioners’ key contentions were:

- APAAR effectively operates as a State-run surveillance mechanism, enabling long-term tracking and profiling of children’s educational trajectories.[3]

- Extensive collection and retention of student data risks use beyond education, raising serious privacy and data protection concerns.[4]

- The petitioners had separately communicated to their schools an unequivocal refusal to consent to generation of an APAAR ID for their children.[5]

- Despite the Government’s position that APAAR is voluntary, schools were, in practice, pressuring parents to submit Aadhaar details by threatening to deny admission, block board examination registration, or withhold services, with some schools even warning that their recognition or state funding could be at risk if APAAR enrolment targets were not met.[6]

- The CBSE circular dated July 30, 2025, made APAAR ID generation a mandatory precondition for registering students of Classes IX to XII for board examinations from the 2026 academic session.[7]

The petitioners argued that together these measures made “consent” illusory and effectively compelled mandatory participation. On that basis, they contended that the scheme failed the constitutional tests of legality, legitimate aim, necessity, and proportionality governing State action, impinging on the right to privacy, as laid down in Justice K.S. Puttaswamy (Retd.) v. Union of India.[8]

What the Supreme Court’s Order Operationally Does

The Supreme Court did not decide APAAR’s constitutional validity on merits. Instead, by its order, it took a calibrated, remedial route. It relied on the approach in Rohit Anand Das v. State of Odisha, W.P.(C) No. 8285 of 2025[9] (“HC Judgment”), where the Orissa High Court had examined the APAAR consent form and identified the following critical gaps:

- The consent form had no option to refuse consent at the outset, i.e., parents could only “withdraw” consent after already giving it and sharing data, which the Orissa High Court found meaningless as a safeguard.[10]

- Since APAAR was admittedly voluntary, the Orissa High Court held the form must actually give parents a clear option to refuse.[11]

- It flagged that children cannot legally consent on their own, making genuine, uncoerced parental consent even more critical.[12]

Building on this reasoning, the Supreme Court directed that the APAAR consent form be amended to expressly give parents or guardians the option to withhold or refuse consent.[13] It disposed the writ petition with the following notings and directions:

- Privacy concerns around APAAR are valid, and the fact that it is an administrative scheme rather than a law does not diminish those concerns.

- All handling of student data under APAAR, i.e., collection, processing, storage, sharing, or use, must fully comply with the DPDPA, including duties to process data lawfully, keep it secure, and use it only for the specific purposes for which it was collected.[14]

A Nudge Towards DPDPA Compliance for Educational Institutions

The broader takeaway is clear. Educational institutions must comply with the DPDPA. This would require educational institutions to undertake a thorough evaluation of their data practices, including understanding what personal data is collected and how, the purposes for which it is used, and the entities with whom it is shared.

Most importantly, consent for the collection and use of personal data (particularly children’s data) must be free, informed, specific, and purpose-limited, and not a one-time, bundled declaration at the time of admission. Educational institutions must treat this as a comprehensive governance exercise spanning admissions, classroom engagement, vendor and ed-tech arrangements, data retention, security controls, and grievance redressal.

The timeline is tight. With May 2027 closer than it appears, educational institutions must act now as compliance with DPDPA should be core institutional priority, not a last-minute legal formality.

[1] Abhishek Baxi v. Union of India, 2026 SCC OnLine SC 1391 (Writ Petition (Civil) No. 832/2026)

[2] Abhishek Baxi case, at para 4.

[3] Abhishek Baxi case, at para. 3.

[4] Ibid.

[5] Ibid.

[6] Abhishek Baxi case, at para. 6.

[7] Abhishek Baxi case, at para. 4.

[8] (2017) 10 SCC 1.

[9] Rohit Anand Das v. State of Odisha, 2025 SCC OnLine Ori 4535.

[10] HC Judgment, at paras 18 and 19.

[11] HC Judgment, at para 18.

[12] HC Judgment, at para 16.

[13] Abhishek Baxi case, at para 7.

[14] Abhishek Baxi case, at para 8.

[15] Abhishek Baxi case, at para 9.

Powered by Nyaya 247 News