Can a school track children for safety? What the DPDP Rules say

If your school uses GPS on buses, a parent app, or QR codes at the gate, you are handling children's personal data. Since the Digital Personal Data Protection (DPDP) Rules were notified, principals keep asking us the same question: can a school still track children for safety under the DPDP Rules, or does it now need every parent's consent first?

The short answer is yes, schools can track children on the journey for their safety, but only within clear limits. This guide explains the rule in plain words, what the exception covers and what it does not, and what you should put in place before the deadline.

The law in one paragraph

The Digital Personal Data Protection Act, 2023 sets the rules for how organisations collect and use personal data in India. The detailed DPDP Rules were notified on 14 November 2025. A few rules came into force at once, and most of the duties schools care about (Rules 3, 5 to 16, 22 and 23) apply eighteen months after notification, which is around May 2027. Under the Act, anyone under 18 is a child.

The two special rules for children

Section 9 of the Act gives children extra protection. Two parts matter most for schools:

• Parent's consent (Section 9(1)). Before processing a child's personal data, an organisation must get the verifiable consent of a parent or lawful guardian. Rule 10 explains how: the organisation must check that the person giving consent is really an adult parent or guardian, for example using details it already holds or a government-backed digital token.
• No tracking (Section 9(3)). An organisation must not track children, monitor their behaviour, or target advertising at them.

Read on their own, these two rules would make live bus tracking and gate check-ins very difficult. That is why the Rules include exceptions.

The exception for schools and school transport

Rule 11 and the Fourth Schedule to the DPDP Rules exempt certain organisations from Section 9(1) and 9(3), each under a strict condition. Two entries apply to schools:

In practice, this means a school can show parents where the bus is, record when a child boards and gets down, and raise an alert if a child does not reach school, because that tracking is for the child's safety. The school's transport partner can do the same, during the journey.

What the exception does not cover

This is where schools most often get it wrong. The exception is narrow:

• It is about tracking, not everything else. Publishing children's photos on social media, sharing data with a marketing partner, or selling anything to parents based on children's data is not covered. Those still need proper consent.
• It is about safety, not convenience. Using location history to judge a child's behaviour, rank students or for anything unrelated to their safety moves outside the exception.
• The other duties still apply. A school is still a "data fiduciary". It must give a clear notice of what it collects and why, keep data secure, report a personal data breach, and delete data when it is no longer needed.

The penalties are serious. The Act allows fines of up to ₹200 crore for breaching the children's provisions and up to ₹250 crore for failing to protect data with reasonable security safeguards.

Who is responsible: the school or the app?

Under the DPDP Act, the organisation that decides why and how data is used is the data fiduciary. For students' transport data, that is usually the school. A technology company that runs the tracking or attendance system for the school is usually a data processor: it handles data on the school's instructions.

The school stays answerable to parents. So when you choose a vendor, ask:

• Where is the data stored, and who inside the vendor can see it?
• How long is location history kept, and can it be deleted on request?
• Will the vendor tell you quickly if there is a breach?
• Is the data ever used for advertising or shared with anyone else? (The answer should be no.)
• Is there a written agreement that sets all of this out?

A checklist for schools before May 2027

• List every place you collect children's data: admissions, transport, attendance, ID cards, fees, the parent app.
• For each one, write down the purpose. Mark which ones are safety tracking on the journey and which are not.
• Prepare a short, plain-language notice for parents, in English and your local language, explaining what you collect and why.
• Collect verifiable parent consent for anything outside the safety exception, such as photos in newsletters or social media.
• Sign data processing agreements with your transport and software vendors.
• Decide how long you keep location and attendance history, and delete it after that.
• Name one person who handles data questions and complaints from parents.
• Write a simple plan for what to do if data leaks, including who informs parents and the Data Protection Board.

What this means for parents

For parents, the change is good news. A school that tracks the bus must use that information only to keep children safe, explain what it collects, protect it, and not use it to sell anything. If you want to know what your school does with your child's data, it is fair to ask. Our guide on questions every parent should ask about the school bus has a few to start with.

Done well, the DPDP Rules do not stop schools from keeping children safe. They make sure safety tools stay safety tools.

BOBOK Editorial Team

We build school transport safety software for schools in India. Our guides are researched from official notifications and reviewed before publishing.