← Back to NIKSHA OS

NIKSHA OS — Children's Data & Consent Policy

Version 2.0 · Last updated 7 October 2026

Applies to: the NIKSHA OS application and backend services operated by NIKSHA Technologies ("NIKSHA OS", "we", "us").

This policy explains how children's personal data is handled in NIKSHA OS and who is responsible for the consent the law requires. It should be read together with the Privacy Policy and the Institution Agreement.

1. Why this matters

NIKSHA OS is a school management platform. Almost everyone it is about — students — is a child. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), a child is anyone under 18 years of age, and processing a child's personal data carries specific obligations (section 9). This policy sets out, in plain terms, how those obligations are met and how responsibility is split between the school (Institution) and NIKSHA OS.

2. Who is responsible for what

In short: the school owns the relationship with the parent and the child; NIKSHA OS is the secure tool the school uses.

3. The educational-institution exemption — what it does and does not cover

Rule 12 and the Fourth Schedule of the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) exempt certain classes of Data Fiduciary from the verifiable-parental-consent requirement (section 9(1)) and the bar on tracking and behavioural monitoring (section 9(3)), subject to narrow conditions:

• An educational institution — but the Schedule's condition is that the "processing is restricted to tracking and behavioural monitoring— (a) for the educational activities of such institution; or (b) in the interests of safety of children enrolled with such institution".
• A Data Fiduciary engaged by an educational institution to transport its children — restricted to "tracking the location of such children, in the interests of their safety, during the course of their travel to and from" the institution.

These provisions of the Act and Rules apply from 13 May 2027 (eighteen months after the Rules were published).

What this means in practice:

• Read narrowly, the exemption covers tracking and behavioural monitoring (for example attendance and safety monitoring) for educational activities or child safety. It does not clearly cover all routine processing of a child's data. From 13 May 2027 a school should therefore expect to hold the verifiable consent of a parent for processing its students' data unless a particular use falls within the exemption or another provision of the law. Rule 10 lets a school verify the parent using reliable identity and age details it already holds (for example its admission records) or a token from an authorised entity such as DigiLocker. Whether a particular use is exempt is for the Institution, as Data Fiduciary, to decide, ideally with its own legal advice. NIKSHA Technologies does not make that determination for it.
• Anything outside educational activities or child safety — for example photographs used for publicity or social-media posts, or optional AI features that go beyond the school's own administration — needs the parent's verifiable consent unless another lawful ground applies.
• Live online classes are available where a school enables them. Streaming and especially keeping a recording that captures a child's voice or image, and letting children switch on their own camera, are uses a school should consider carefully: we recommend that the school obtains the parent's verifiable consent covering live classes and recordings, and uses the teacher-controlled speaking mode. See Privacy Policy §3.7A.
• The exemption covers section 9(1) and 9(3) only. Every other DPDP obligation continues to apply in full: notice, purpose limitation, accuracy, security safeguards, breach intimation, retention limits, and the parent's rights.
• The ban on processing that is likely to cause a detrimental effect on a child's well-being (section 9(2)) is not exempted, and applies always.

4. Verifiable parental consent

Where consent is the basis being relied on:

• The Institution obtains and records the parent's / lawful guardian's verifiable consent. This is the school's responsibility as Data Fiduciary. Under Rule 10, the school must take appropriate steps to check that the person giving consent is the child's parent and an identifiable adult — for example using identity and age details it already holds reliably (such as admission records), or a token from a government-authorised service such as DigiLocker.
• What NIKSHA OS records today. When a parent first signs in, the app asks the parent to accept the Privacy Policy, the Parent & User Terms and the Terms & Conditions, and records the policy version, the accepting user, their role, the Institution, the timestamp, the IP address, the device and the app version. The parent's account exists only because the Institution linked that parent to the child.
• Express parent statement (added 9 October 2026, not yet reviewed by an advocate). The documents the parent accepts now contain an express statement that, by accepting, the parent confirms they are the child's parent or lawful guardian, consents to the child's school-provisioned student account, allows the child to take part in live online classes (microphone, camera and any recording the teacher chooses to save), and may withdraw this by contacting the school or using Delete account (Terms & Conditions §3.5; Parent & User Terms §3).
• What NIKSHA OS does not do today. The in-app acceptance is a record that the parent accepted our documents. It is not, by itself, a per-purpose, per-child verifiable consent, and there is no in-app screen to give or withdraw consent for a specific optional purpose. Until such a screen exists, the Institution must obtain and record any consent it needs outside the app (for example on its admission form) and keep that record.
• NIKSHA OS does not independently determine a child's age or a parent's identity; the parent ↔ child link is established by the Institution during enrolment.

5. What NIKSHA OS will never do with children's data

• ❌ No behavioural tracking of children for any purpose of our own.
• ❌ No profiling of children for advertising.
• ❌ No targeted or interest-based advertising directed at children — and no advertising at all.
• ❌ No sale or rental of children's data.
• ❌ No use of children's data to train our own or third-party AI models.
• ❌ No sharing with data brokers.
• ❌ No face recognition of students.
• ❌ No tracking of a student's personal location. Where the school runs transport, the school vehicle's position is recorded during a trip, for the safety of the children on board.

AI features in NIKSHA OS operate only on data the requesting user is already authorised to see, to assist school staff and parents — never to build profiles of children for any outside purpose. See the AI Usage & Disclaimer.

6. A child's own account (older students)

Some schools give students their own login (e.g. to see homework, results, timetable). When a student uses NIKSHA OS:

• They see only their own records (enforced by role-based access control and row-level security).
• The account exists because the school enrolled them; the school remains responsible for the lawful ground and any consent.
• Students are not asked to accept terms in the app themselves; the Institution and the parent accept the documents that apply. The notice to the parent (and, in age-appropriate words, to the child) is the school's responsibility as Data Fiduciary.
• Student-facing screens carry no advertising and no third-party trackers.
• The in-app assistant answers students from the school's records using our own software only; a student's words are never sent to an AI model.
• Students do not share their location; the app does not ask a student for location permission.

7. In-app acceptance & records

On first login, and whenever a mandatory policy is updated to a new version, the relevant user (parent, staff, principal) is asked to review and accept the applicable documents before continuing. NIKSHA OS records, for each acceptance:

• the user and their role,
• the Institution / tenant they belong to,
• the policy key and version accepted,
• the timestamp, and
• the IP address, device identifier, app version and platform (where available).

These records let an Institution demonstrate who agreed to what version and when — which supports the Institution's accountability as Data Fiduciary. Acceptance records are append-only and are retained per the Retention Policy.

8. Parents' rights regarding their child's data

A parent or lawful guardian may, on the child's behalf:

• obtain a summary of the child's personal data being processed and of the processing activities,
• request correction, completion or updating of inaccurate data,
• request erasure when the data is no longer needed for a lawful purpose (subject to records the school must keep by law),
• withdraw consent where processing relies on consent (this does not affect processing already done, or processing on another lawful ground),
• nominate another person to exercise these rights in the event of the parent's death or incapacity, and
• raise a grievance.

Because the Institution is the Data Fiduciary, parents should first contact their school. NIKSHA Technologies will assist the school in fulfilling valid requests. A parent may also contact our Grievance Officer at support@nikshaos.in — we acknowledge within 24 hours and aim to resolve within 15 days, involving the school where it holds the record — and, after using the grievance process, may complain to the Data Protection Board of India.

9. Data breaches involving children's data

If a personal-data breach affecting children's data occurs, NIKSHA Technologies will, as processor, notify the affected Institution without undue delay and assist it to intimate the Data Protection Board and affected parents within the timelines required by the DPDP Rules (see the Security & Responsible Disclosure Policy, Part B).

10. Changes

This policy will be updated as the DPDP Rules' children's-data provisions take effect (13 May 2027) and as guidance from the Data Protection Board is issued. Material changes are recorded in the CHANGELOG and surfaced in-app.

11. Contact

NIKSHA Technologies — Grievance Officer: N. Surendra, support@nikshaos.in. Privacy contact: support@nikshaos.in.