Supreme Court APAAR order and the DPDP Act: what it directs

Children

By Abhijeet Singh · Primary sources verified by dpdprules.orgPublished 19 October 2026 · Last reviewed 21 October 202613 min read

What does the Supreme Court's APAAR order of 20 July 2026 mean for parents and schools?

The short answer

On 20 July 2026 a 3 judge bench of the Supreme Court of India disposed of W.P.(C) 832/2026, Abhishek Baxi v Union of India, a challenge by parents to the APAAR Scheme. Paragraph 7 directs that paragraph 19 of the Orissa High Court's judgment of 12 December 2025 in Rohit Anand Das v State of Odisha, which directed the authorities "to consider amendment of the model consent form to include an opt out/refusal of consent option therein", be given effect across India. Paragraph 8 says processing of personal information under the Scheme shall be strictly governed by the Digital Personal Data Protection Act, 2023. Paragraph 9 says personal information cannot be disclosed to any private entity or third party except in accordance with law. The order names the Act 1 time, cites 0 sections and says nothing about commencement. For a parent, the Court called an option to refuse "essential" to meaningful consent; the order does not say what follows a refusal. For a school, paragraph 7 gives effect to the direction "by the concerned authorities implementing the APAAR Scheme"; on this site's reading the amendment is not for each school to draft. Section 2 of the Act, with the definitions of child and Data Fiduciary, has been in force since 13 November 2025; sections 4, 5, 7 to 10 and section 6 except sub section (9), and Rule 10, commence 18 months after publication, computed 13 May 2027, interpretation until officially confirmed.

What the order means, for a student, a parent and a school

For a student. The order says nothing about existing APAAR IDs, and cancels none; the portal counter read "33.74 cr APAAR ID Registered" on 19 October 2026. Paragraph 9, which the Court introduces with "It goes without saying", says personal information cannot be disclosed to a private entity or third party except in accordance with law; it is the Court's text, not a requirement of the Act; reading it as a binding term of the disposal is this site's interpretation.

For a parent. Paragraph 7 gives effect across India to the Orissa High Court's direction that the authorities consider amending the model consent form "so as to expressly provide an option enabling parents or guardians to withhold or refuse consent", and calls that safeguard "essential". The order does not say what follows a refusal, and gives no direction about the 2 CBSE circulars that, the petitioners said, made an APAAR ID "a mandatory precondition for the registration of students of Classes IX to XII for Board examinations".

For a school. Paragraph 7 gives effect to the direction "by the concerned authorities implementing the APAAR Scheme"; on this site's reading the amendment is not for each school to draft. Paragraph 6 records, as an allegation and not a finding, schools "threatening the denial of admission, registration for Board examinations, and access to other educational services". On this site's reading paragraph 9 reaches a school passing APAAR collected details to an edtech vendor without a law that authorises it.

What APAAR is, in the Government's own words

Explanation, from 4 official pages captured on 19 October 2026. Per its Terms of Use APAAR is "a service provided by the Ministry of Education"; the PIB factsheet of 4 July 2026 put 16.62 crore APAAR IDs in school education as at 2 July 2026. The home page lists 9 mandatory details, ending "Name as per Aadhaar, Aadhaar Number", each, on this site's reading, personal data under section 2(t), in force since 13 November 2025. 3 absences matter, and the order's paragraph 7 addresses the 1st of them: none of the 3 captured portal pages says a parent may refuse or what follows a refusal, the portal's word being "voluntarily"; none of the 3 captured portal pages names the DPDP Act or the Aadhaar Act; and none of the 3 captured portal pages states a legal basis for collecting the Aadhaar number. The Terms of Use, at their line 75, send the reader to "the Privacy Policy available on the APAAR platform" for "the collection, processing, and storage of your academic data"; that Privacy Policy, the full FAQs page and the Resources page were not captured, so these are absences from 3 pages and not from the portal as a whole. "Digital Personal Data" appears 0 times on the 3 portal pages and 1 time in the factsheet, about a blockchain platform and not APAAR.

What the order is

Explanation, with 1 inference flagged. A Record of Proceedings before 3 judges, the Chief Justice, Justice Joymalya Bagchi and Justice V. Mohana. Parents of students in CBSE affiliated schools petitioned under Article 32 against 2 things, registration under the Scheme and "the requirement of furnishing Aadhaar details as a precondition for such registration", with 1 application for ex parte ad interim relief. Paragraph 10 disposes of the petition, paragraph 11 records that "the respondents have not been heard at this stage", and no further date follows; calling that a disposal at 1st listing is this site's inference.

What the order says: paragraphs 7 to 11, verbatim

Labelled explanation: the Court's order, never a requirement of the Act. Only paragraph 7 uses the words "we direct"; paragraph 8 opens with "we consider it necessary to clarify" and paragraph 9 with "It goes without saying". On this site's reading, interpretation, paragraph 10's "in the aforesaid terms" makes paragraphs 8 and 9 terms of the disposal.

The source's own words, quoted; not a requirement of the DPDP framework · Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme), 7

"Having considered the attending circumstances and the submissions advanced on behalf of the Petitioners, we are inclined to adopt the approach taken by the High Court of Orissa at Cuttack in Rohit Anand Das v. State of Odisha [W.P.(C) No. 8285 of 2025], wherein the State authorities were directed to consider suitably amending the model consent form prescribed under the APAAR Scheme so as to expressly provide an option enabling parents or guardians to withhold or refuse consent. We are of the considered view that such a safeguard is essential to ensure that the requirement of consent is meaningful and informed. Accordingly, we direct that the directions contained in paragraph 19 of the aforesaid judgment shall be given effect to on a pan-India basis by the concerned authorities implementing the APAAR Scheme."

Paragraph 7, PDF page 4.

The direction paragraph 7 adopts is in paragraph 19 of the Orissa judgment of 12 December 2025, under which the authorities "are directed to consider amendment of the model consent form to include an opt out/refusal of consent option therein" (explanation); it is quoted in full in the section on paragraph 19 below.

Paragraph 8 calls concerns regarding the possible misuse of "the personal information of those who voluntarily opt to enrol under the APAAR Scheme" "misconceived", then continues:

"Merely because the collection of such information is undertaken pursuant to an administrative scheme and not under a statutory mandate does not absolve the authorities of their obligations in relation to the protection of personal data. Any collection, processing, storage, retention, sharing, or use of personal information under the APAAR Scheme shall, therefore, be strictly governed by the provisions of the Digital Personal Data Protection Act, 2023, and the obligations cast thereunder upon data fiduciaries to ensure the lawful, secure, and purpose-limited processing of personal data. The concerned authorities shall obviously ensure scrupulous compliance with the safeguards prescribed under the said enactment."

Paragraph 8, PDF page 5.

"It goes without saying that any personal information collected pursuant to the APAAR Scheme cannot be disclosed, shared, or otherwise made available to any private entity or third party except in accordance with law and strictly for purposes authorized thereunder. Any sharing of such information beyond the scope of the Scheme or for extraneous purposes shall be impermissible."

Paragraph 9, PDF page 5.

Paragraph 10 disposes of the petition "in the aforesaid terms". Paragraph 11:

"Since the respondents have not been heard at this stage, liberty is granted to them to seek any clarification, if so"

Paragraph 11, PDF page 5. The closing word, required, sits at the top of page 6.

The Act the order applies, and when its duties begin

The order (explanation). Paragraph 8 names the Act 1 time, by title, and points at "the obligations cast thereunder upon data fiduciaries"; it cites 0 sections and 0 Rules, names the Board 0 times, and says nothing about what is in force.

Section 2 is in force (official), since publication of G.S.R. 843(E), printed as 13 November 2025, under its paragraph (a). Section 2(i) defines a Data Fiduciary as "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data"; section 2(s) says a person includes "( vi ) the State"; section 2(f) defines a child as "an individual who has not completed the age of eighteen years". Read together, explanation and not a finding about any body: the State is a person, a person that determines purpose and means is a Data Fiduciary, and a student under 18 is a child. On this site's reading (interpretation), the order's lower case "data fiduciaries" points at the term section 2(i) defines, which is in force today; the duties attached to it are not.

Who that is for APAAR (interpretation). The Terms of Use define APAAR as "a product of Ministry of Education, integrated with Academic Bank of Credits", and the About page says "Schools: Record and manage students' academic data, achievements, and activities in APAAR." On this site's reading the Ministry of Education, which decides why the ID exists and what it collects, is the Data Fiduciary; a school that sets its own purposes for the data is a Data Fiduciary for those, on the split the schools and edtech guide carries. The order names neither.

Sections 4, 5, 7 to 10 and section 6 except sub section (9) are not in force (official). Paragraph (c) places "sections 3 to 5" and "sections 7 to 10" at "eighteen months from the date of publication of this gazette": a computed 13 May 2027, interpretation until officially confirmed; the 13th or 14th question is on the 13 or 14 November page. Paragraph (b) puts sections 6(9) and 27(1)(d) at 1 year, computed 13 November 2026; on this site's reading (interpretation), neither touches this scheme, though the notification does not say so.

Where that leaves the tension (interpretation). 3 statements this site draws from the texts: the order binds its addressees from 20 July 2026 as a court order, subject to any clarification; the Act's obligations commence on the computed 13 May 2027 and the order does not purport to move that date; and the order's yardstick, the provisions of the Act, exists in full today, so an authority can measure its processing against it now. 2 statements are not supported, and this site does not make them: that the order brings any section into force early, and that it is satisfied by doing nothing until May 2027. Which obligations bind the authorities between the 2 dates, and against what sanction, is left to the addressees and to paragraph 11; no primary source answers it as at 19 October 2026.

Section 9, Rule 10 and the Fourth Schedule

These belong to the children's data guide and the schools guide. Section 9(1) is what the consent form will have to satisfy. It requires the Data Fiduciary, before processing the personal data of a child, or of a person with disability who has a lawful guardian, to "obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed" (Gazette page 8, as modified by S.O. 5458(E), paragraph 2(i), which adds the word of). Not in force until 18 months after 13 November 2025, computed 13 May 2027.

S.O. 5458(E), in force since its publication, printed as 6 October 2026 (Gazette No. 5248), substitutes "child or of a person with disability", adding the word of, and leaves commencement untouched; see the Removal of Difficulties Order page. Section 9(3) prohibits "tracking or behavioural monitoring of children or targeted advertising directed at children", on the same commencement; whether any Fourth Schedule entry lifts section 9 for APAAR processing is the Fourth Schedule education exemption guide's question, and this page does not answer it.

Rule 1(4), as corrected by corrigenda G.S.R. 892(E), puts "Rules 3, 5 to 16, 22 and 23" at 18 months, so Rule 10 and Rule 12 commence on the computed 13 May 2027; Rule 1 itself is in force. After that date an APAAR consent step must meet Rule 10(1), under which the Data Fiduciary "shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable", by reference to 2 classes of evidence that the verifiable consent guide explains.

A different petition from the challenge to the Act

W.P.(C) 832/2026 is not the constitutional challenge to the Act, the Nayak batch led by W.P.(C) 177/2026, tracked on the Supreme Court challenge page. On this site's reading, as a writ petition, not a suit or a Board complaint, neither the section 39 bar, in force since 13 November 2025, nor section 27 except clause (d) of sub section (1), in the 18 month group computed 13 May 2027, arose; both are on can I sue under the DPDP Act.

Paragraph 19 of the Orissa judgment

Explanation, from the judgment itself. The High Court of Orissa at Cuttack, Justice Sashikanta Mishra sitting alone, delivered judgment in Rohit Anand Das v State of Odisha, W.P.(C) No. 8285 of 2025, on 12 December 2025; this site holds the official copy served by eCourts. Paragraph 19, the paragraph the Supreme Court's paragraph 7 gives effect to across India, reads:

The source's own words, quoted; not a requirement of the DPDP framework · High Court of Orissa, judgment of 12 December 2025 in Rohit Anand Das and another v State of Odisha and others, W.P.(C) No. 8285 of 2025 (the APAAR consent form), 19

"Resultantly, the Writ Petition is allowed. The opposite party-authorities are directed to consider amendment of the model consent form to include an opt out/refusal of consent option therein. The model consent form incorporating such changes as provided by learned counsel for the Petitioners to the learned DSGI may also be considered. Necessary orders in this regard shall be passed within two months from today."

Paragraph 19, PDF page 20.

3 limits on what that text supports. First (explanation), it directs the authorities to consider an amendment; it does not itself amend the form or strike down the scheme. Second (interpretation), the 2 months ran from 12 December 2025, computed 12 February 2026, because the judgment says "within two months from today" and gives no date. Third, this site holds no record of whether Odisha amended the form, so this page does not say that any amended form is in use. The Supreme Court's paragraph 7 describes the same direction as one to consider "suitably amending" the form and gives it effect across India; on this site's reading (interpretation), the judgment's own words are consistent with that description, though the judgment directs the opposite party authorities rather than State authorities and does not use the word suitably.

What this means in practice

5 recommendations of this site, not requirements of the order or the Act.

A parent who does not want an APAAR ID should refuse in writing (this site's recommendation); paragraph 3 records the petitioners' submission that they had communicated their refusal to their schools. Cite paragraph 7: the option to withhold or refuse consent that the Court called essential to meaningful and informed consent.
On this site's reading, a school should not redraft the model form. Paragraph 7 gives effect to the direction "by the concerned authorities implementing the APAAR Scheme"; record each refusal.
An implementing authority should state the 4 disclosures counsel said the form lacked: purpose, scope, retention period and data sharing practices. The order directs none, but consent the Court wants "meaningful and informed" points that way.
A school and an authority should map where APAAR data goes, reading 3 flows against paragraph 9: retrieval "from the UIDAI servers", an ID "pushed into student's DigiLocker Account", and "sharing information only with necessary government agencies". Each needs a named law and purpose.
Everyone should prepare for 13 May 2027. On this site's reading, section 9(1) and Rule 10 will then apply, on that computed date, to whichever body is the Data Fiduciary for the consent step, subject to the Fourth Schedule question the schools guide frames.

Questions this page gets asked

Can a parent refuse an APAAR ID after the Supreme Court order? The order gives effect across India to the Orissa High Court's direction to consider amending the model consent form "so as to expressly provide an option enabling parents or guardians to withhold or refuse consent", and calls that safeguard essential. What follows a refusal it does not say.

Does the APAAR order mean the DPDP Act is in force for student data? Not in the commencement sense. It cites 0 sections and says nothing about commencement. Section 2 has been in force since 13 November 2025; sections 4, 5, 7 to 10 and section 6 except sub section (9), and Rule 10, commence on a computed 13 May 2027, interpretation until officially confirmed. The order binds its addressees from 20 July 2026 as a court order; on this site's reading (interpretation) it brings no provision into force, because commencement is fixed by notification under section 1(2), which G.S.R. 843(E) recites; which obligations bind the authorities before 13 May 2027 is left open, as the section above explains.

Is this the same case as the Supreme Court challenge to the DPDP Act? No. That is the Nayak batch, W.P.(C) 177/2026. W.P.(C) 832/2026 challenged the APAAR Scheme, not the Act.

Verified against the Supreme Court's Record of Proceedings of 20 July 2026, the 3 APAAR portal pages and the PIB factsheet as captured, and the Gazette texts of the Act, the Rules, G.S.R. 843(E) and S.O. 5458(E), on 19 October 2026, and against the Orissa High Court's judgment of 12 December 2025 on 21 October 2026.

Related tool

Children's Data Checker

See whether child data obligations or exemptions are triggered and what they require.

Open

All 11 free DPDP tools →

Section 9, Rule 10 and the Fourth Schedule: the children's data guide →What the Fourth Schedule education exemption really covers →What verifiable parental consent requires under Rule 10 →The separate constitutional challenge, the Nayak batch →Section 39, the Board route and why there is no suit under the Act →S.O. 5458(E), the word it added to section 9(1) →Section 9, official text with sources →DPDP for education and edtech →

Apaar Supreme Court Parental consent Section 9 Schools Aadhaar

Sources cited on this page

[1]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 1, p. 1. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
challenging the constitutional validity of the Automated Permanent Academic Account Registry (APAAR) Scheme
Paragraph 1 of the order, PDF page 1, found at extraction line 1 (preamble print order). The words are read from the extraction's header, which records the print order of that paragraph because the digital signature stamp in the page 1 margin is spliced into its lines by the extractor. A court order records what the Court did; it is never itself a DPDP requirement, so no citation of it on this page is typed official.
[2]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 1, p. 2. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
are aggrieved by: (i) the registration of students under the APAAR Scheme; and (ii) the requirement of furnishing Aadhaar details as a precondition for such registration.
The tail of paragraph 1 on PDF page 2: the 2 grievances of the petitioners, who paragraph 1 says are parents of students enrolled in schools affiliated with the Central Board of Secondary Education.
[3]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), p. 1. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
Date : 20-07-2026 This matter was called on for hearing today.
The date line on PDF page 1. The order is headed Record of Proceedings, Item No. 12, Court No. 1, Section X, in Writ Petition(s)(Civil) No(s). 832/2026, Abhishek Baxi and others versus Union of India and others.
[4]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), p. 1. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
HON'BLE THE CHIEF JUSTICE HON'BLE MR. JUSTICE JOYMALYA BAGCHI HON'BLE MRS. JUSTICE V. MOHANA
The coram on PDF page 1, 3 judges, with the extraction's line breaks folded to single spaces. 8 counsel are listed for the petitioners, led by Ms. Indira Jaising, Senior Advocate, and 4 for the respondents, led by Ms. Pankhuri Shrivastava.
[5]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), p. 1. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
(IA No. 195873/2026 - EX-PARTE AD-INTERIM RELIEF)
The 1 interim application on the face of the order, PDF page 1, reproduced with its own hyphens.
[6]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 3, p. 2. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
It is the Petitioners' contention that the APAAR Scheme effectively operates as a State-run surveillance mechanism within the education sector by enabling the long-term tracking, profiling, and monitoring of children's educational trajectories. According to the Petitioners, the extensive collection and retention of such data creates the potential for its use beyond the educational sphere, thereby raising serious concerns relating to informational privacy and data protection. The Petitioners further submit that they have communicated to their respective schools their unequivocal refusal to consent to the generation of an APAAR ID for their children.
Paragraph 3, PDF page 2, the petitioners' contention as the Court recorded it, with the extraction's line breaks folded to single spaces. A recital of what was argued, not a finding.
[7]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 3, p. 2. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
they have communicated to their respective schools their unequivocal refusal to consent to the generation of an APAAR ID for their children.
The last sentence of paragraph 3, PDF page 2, cited for the record that the petitioners had already refused to their schools, which is the step this page recommends to a parent who does not want an ID.
[8]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 4, p. 3. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
During the course of hearing, Ms. Indira Jaising, Senior Advocate appearing on behalf of the Petitioners submitted that, although the Ministry of Education, by its Circular dated 11.10.2023, stipulated that parental consent was a prerequisite for the generation of an APAAR ID for students, the prescribed consent form neither provides an option to decline participation nor discloses, in a clear and informed manner, the purpose, scope, retention period, or data-sharing practices relating to the information sought to be collected. She further contended that the Central Board of Secondary Education (CBSE), through Circulars dated 05.08.2025 and 27.08.2025, has made the generation of an APAAR ID a mandatory precondition for the registration of students of Classes IX to XII for Board examinations commencing from the academic session 2026 onwards.
Paragraph 4, PDF page 3, the submission on the consent form and the 3 circulars it names: the Ministry of Education circular of 11 October 2023 and the CBSE circulars of 5 August 2025 and 27 August 2025. None of the 3 is on file, and the order gives no direction about any of them. It names 1 option and 4 disclosures, purpose, scope, retention period and data sharing practices, that the prescribed form was said to lack.
[9]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 6, p. 4. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
Additionally, Ms. Jaising argued that notwithstanding the Government's assertion that the APAAR Scheme is voluntary in nature, educational institutions are, in practice, compelling parents to furnish their children's Aadhaar details by threatening the denial of admission, registration for Board examinations, and access to other educational services. It is also alleged that certain schools have informed parents that their continued recognition, registration, or eligibility for State funding may be jeopardised if prescribed APAAR enrolment targets are not achieved.
Paragraph 6, PDF page 4, with the extraction's line breaks folded to single spaces. An allegation recorded, not a finding: the respondents were not heard.
[10]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 7, p. 4. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
Having considered the attending circumstances and the submissions advanced on behalf of the Petitioners, we are inclined to adopt the approach taken by the High Court of Orissa at Cuttack in Rohit Anand Das v. State of Odisha [W.P.(C) No. 8285 of 2025], wherein the State authorities were directed to consider suitably amending the model consent form prescribed under the APAAR Scheme so as to expressly provide an option enabling parents or guardians to withhold or refuse consent. We are of the considered view that such a safeguard is essential to ensure that the requirement of consent is meaningful and informed. Accordingly, we direct that the directions contained in paragraph 19 of the aforesaid judgment shall be given effect to on a pan-India basis by the concerned authorities implementing the APAAR Scheme.
Paragraph 7, PDF page 4, the consent form direction, with the extraction's line breaks folded to single spaces. It records exactly 5 things about the Orissa judgment: the court, the name and number, the direction to consider amending the model consent form, that the directions sit in paragraph 19, and that they are to be given effect across India by the concerned authorities implementing the Scheme. It gives no date, bench or text for that judgment; the judgment itself, of 12 December 2025, is now on file and cited separately below as ORISSA-HC-ROHIT-ANAND-DAS-2025. The direction it adopts is to consider amending the form; the order does not itself say the form must carry the option.
[11]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 7, p. 4. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
such a safeguard is essential to ensure that the requirement of consent is meaningful and informed
The middle sentence of paragraph 7, PDF page 4, with the extraction's line break folded: the Court's own view that an option to withhold or refuse consent is essential to meaningful and informed consent. Cited for the word essential that the answer, the parent paragraph and the questions section use.
[12]
High Court of Orissa, judgment of 12 December 2025 in Rohit Anand Das and another v State of Odisha and others, W.P.(C) No. 8285 of 2025 (the APAAR consent form) (W.P.(C) No. 8285 of 2025), 19, p. 20. Published 12 December 2025. · The source's own words, quoted; not a requirement of the DPDP framework · Verified 21 October 2026Document status: delivered judgment of 12 December 2025; writ petition allowed, the opposite party authorities directed to consider amending the APAAR model consent form to include an opt out or refusal of consent option, with orders to be passed within 2 months; a court's decision on an Article 21 privacy claim and not a DPDP requirement
Resultantly, the Writ Petition is allowed. The opposite party-authorities are directed to consider amendment of the model consent form to include an opt out/refusal of consent option therein. The model consent form incorporating such changes as provided by learned counsel for the Petitioners to the learned DSGI may also be considered. Necessary orders in this regard shall be passed within two months from today.
Paragraph 19 of the judgment of the High Court of Orissa at Cuttack delivered on 12 December 2025 by Justice Sashikanta Mishra sitting alone, in Rohit Anand Das and another v State of Odisha and others, W.P.(C) No. 8285 of 2025, PDF page 20, extraction lines 627 to 641, paragraph 19 opening at line 621, with the extraction's line breaks folded to single spaces and the hyphen and slash kept as printed. It allowed the writ petition, directed the opposite party authorities to consider amending the model consent form to include an opt out or refusal of consent option, said the petitioners' model form may also be considered, and set 2 months for the necessary orders. A direction to consider an amendment, not an amendment: the judgment does not itself change the form. A High Court judgment and not legislation, so explanation and never an official DPDP requirement.
[13]
High Court of Orissa, judgment of 12 December 2025 in Rohit Anand Das and another v State of Odisha and others, W.P.(C) No. 8285 of 2025 (the APAAR consent form) (W.P.(C) No. 8285 of 2025). Published 12 December 2025. · Interpretation, requires judgment · Verified 21 October 2026Document status: delivered judgment of 12 December 2025; writ petition allowed, the opposite party authorities directed to consider amending the APAAR model consent form to include an opt out or refusal of consent option, with orders to be passed within 2 months; a court's decision on an Article 21 privacy claim and not a DPDP requirementThe date 12 February 2026 is this site's computation of 2 months from 12 December 2025, the date of the judgment, because paragraph 19 says "within two months from today" and gives no calendar date. This site holds no record of whether the Odisha authorities passed orders or amended the model consent form within that period or since.
[14]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 8, p. 4. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
In addition, we consider it necessary to clarify, by way of abundant caution, that concerns regarding the possible misuse of
The opening words of paragraph 8 on PDF page 4. The paragraph continues on PDF page 5, which the next citation carries; the 2 are quoted separately because the page break falls mid sentence.
[15]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 8, p. 5. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
the personal information of those who voluntarily opt to enrol under the APAAR Scheme, are misconceived. Merely because the collection of such information is undertaken pursuant to an administrative scheme and not under a statutory mandate does not absolve the authorities of their obligations in relation to the protection of personal data. Any collection, processing, storage, retention, sharing, or use of personal information under the APAAR Scheme shall, therefore, be strictly governed by the provisions of the Digital Personal Data Protection Act, 2023, and the obligations cast thereunder upon data fiduciaries to ensure the lawful, secure, and purpose-limited processing of personal data. The concerned authorities shall obviously ensure scrupulous compliance with the safeguards prescribed under the said enactment.
Paragraph 8 from the top of PDF page 5 to its end. It names the Act 1 time, by title, lists 6 operations, and refers to the obligations on data fiduciaries in lower case; it cites 0 sections, 0 Rules and 0 notifications and does not mention commencement.
[16]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 9, p. 5. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
It goes without saying that any personal information collected pursuant to the APAAR Scheme cannot be disclosed, shared, or otherwise made available to any private entity or third party except in accordance with law and strictly for purposes authorized thereunder. Any sharing of such information beyond the scope of the Scheme or for extraneous purposes shall be impermissible.
Paragraph 9, PDF page 5, the bar on disclosure to private entities and third parties, with the extraction's line breaks folded to single spaces. The spelling authorized is the order's own.
[17]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 10, p. 5. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
The instant writ petition is, accordingly, disposed of in the aforesaid terms. Pending interlocutory application(s), if any, shall also stand disposed of.
Paragraph 10, PDF page 5, the disposal. No notice issued and no further date fixed.
[18]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 11, p. 5. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
Since the respondents have not been heard at this stage, liberty is granted to them to seek any clarification, if so
Paragraph 11 as far as PDF page 5 carries it. The closing word, required, is printed at the top of PDF page 6 beside the Deputy Registrar's name, so the sentence is quoted up to the page break and its last word is stated in prose. 4 counsel are listed for the respondents on page 1, led by Ms. Pankhuri Shrivastava, yet the order records that they have not been heard; the liberty to seek clarification is theirs.
[19]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026), 12, p. 6. Published 20 July 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarification
Ordered accordingly.
Paragraph 12, PDF page 6, the closing formula. The order is signed by Nitin Talreja, Assistant Registrar cum PS, digitally on 25 July 2026, and by Preethi Dileep Kumar, Deputy Registrar.
[20]
Supreme Court of India, Record of Proceedings, order of 20 July 2026 in Abhishek Baxi & Ors. v Union of India & Ors., W.P.(C) No. 832/2026 (the APAAR scheme) (W.P.(C) No. 832/2026). Published 20 July 2026. Official source ↗ · An official record, not a legal requirement · Verified 19 October 2026Document status: published official court order; writ petition disposed of on 20 July 2026 with directions, the respondents not having been heard, with liberty to them to seek clarificationCounts over the whole 6 page extraction on 19 October 2026: 12 numbered paragraphs, of which paragraph 7 is the 1 paragraph using the words we direct, 2 further paragraphs, 8 and 9, follow it, and paragraphs 10 and 11 dispose of the petition and grant liberty; the Digital Personal Data Protection Act, 2023 named 1 time by title; 0 sections of the Act cited; 0 mentions of G.S.R. 843(E) or of commencement; 0 mentions of the DPDP Rules 2025; 0 mentions of the Data Protection Board; 3 circulars named in submissions; 1 High Court judgment adopted; 1 Supreme Court precedent cited, Puttaswamy, in paragraph 5.
Also cited on this page · Interpretation, requires judgment · Verified 19 October 20265 readings on this page are this site's and not the order's. First, the description of the disposal as one at first listing: the order does not use those words, and the inference rests on the date line, the ex parte ad interim application and paragraph 11; a cause list or case status record would be needed to state it as fact. Second, the commencement contrast: the order applies the Act to live processing while the Data Fiduciary obligations in sections 4, 5, 7 to 10 and section 6 except sub section (9) sit in the 18 month group of G.S.R. 843(E), computed 13 May 2027, interpretation until officially confirmed. This page states what each text says and does not read the order as advancing any date or the notification as emptying the direction. Third, that the direction binds its addressees from the date of the order, 20 July 2026, as a court order, subject to any clarification sought under paragraph 11; no record of a clarification is held as at 19 October 2026. Fourth, that paragraph 9 reaches a school's onward sharing with a vendor. Fifth, that paragraph 10's words in the aforesaid terms make paragraphs 8 and 9 terms of the disposal: the order does not label them so, and paragraph 8 is itself worded as shall be strictly governed and shall obviously ensure scrupulous compliance.
[21]
APAAR, Automated Permanent Academic Account Registry, One Nation One Student ID (official portal home page, apaar.education.gov.in), FAQ 6, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the Government's own description of the APAAR student ID, its registration steps including a parental consent form, the Aadhaar and PEN prerequisites and the DigiLocker push; a scheme description and not an instrument, it names no statute, no notification and no DPDP provision
UDISE+ Unique Student Identifier (PEN), Student Name, Date of Birth (DOB), Gender, Mobile Number, Mother's Name, Father's Name, Name as per Aadhaar, Aadhaar Number
Home page, FAQ 6, extraction line 73, which follows line 72, reading The following student details are mandatory for APAAR ID creation. 9 details are listed, and each is personal data under section 2(t) of the Act on this site's reading.
[22]
APAAR, Automated Permanent Academic Account Registry, One Nation One Student ID (official portal home page, apaar.education.gov.in), How to Get The APAAR, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the Government's own description of the APAAR student ID, its registration steps including a parental consent form, the Aadhaar and PEN prerequisites and the DigiLocker push; a scheme description and not an instrument, it names no statute, no notification and no DPDP provision
Parents fill up consent form voluntarily for APAAR ID creation
Home page, step 2 of the 4 step panel headed How to Get The APAAR, extraction line 44. The word voluntarily is the portal's; the form itself is on none of the 4 captured official web pages, and none of the 3 captured portal pages says that a parent may refuse or what follows a refusal, checked 19 October 2026. The portal Privacy Policy, the full FAQs page and the Resources page were not captured.
[23]
APAAR, Automated Permanent Academic Account Registry, One Nation One Student ID (official portal home page, apaar.education.gov.in), How to Get The APAAR, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the Government's own description of the APAAR student ID, its registration steps including a parental consent form, the Aadhaar and PEN prerequisites and the DigiLocker push; a scheme description and not an instrument, it names no statute, no notification and no DPDP provision
APAAR ID is pushed into student's DigiLocker Account
Home page, step 4 of the same panel, extraction line 48. Cited as 1 of the 3 flows this page recommends be read against paragraph 9 of the order.
[24]
APAAR, Automated Permanent Academic Account Registry, One Nation One Student ID (official portal home page, apaar.education.gov.in), p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the Government's own description of the APAAR student ID, its registration steps including a parental consent form, the Aadhaar and PEN prerequisites and the DigiLocker push; a scheme description and not an instrument, it names no statute, no notification and no DPDP provision
33.74 cr APAAR ID Registered
Home page counter, extraction line 18, as it read on 19 October 2026. A different measure from the PIB figure of verified IDs, taken on a different date; the 2 are not equated or subtracted on this page.
[25]
APAAR, Automated Permanent Academic Account Registry, One Nation One Student ID (official portal home page, apaar.education.gov.in). Official source ↗ · An official record, not a legal requirement · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the Government's own description of the APAAR student ID, its registration steps including a parental consent form, the Aadhaar and PEN prerequisites and the DigiLocker push; a scheme description and not an instrument, it names no statute, no notification and no DPDP provisionDated absences across the 3 portal captures, home, About and Terms of Use, checked 19 October 2026: the DPDP Act, any Rule, the Aadhaar Act and any notification are named 0 times; the phrase Digital Personal Data occurs 0 times on the 3 portal pages and 1 time in the PIB factsheet, at its line 143, about a blockchain credentials platform and not APAAR; none of the 3 captured portal pages says a parent may refuse, what the form says or what follows a refusal; none of the 3 captured portal pages states a legal basis for collecting the Aadhaar number. The Terms of Use, at extraction line 75, refer the reader to the Privacy Policy available on the APAAR platform for the collection, processing and storage of academic data; that Privacy Policy, the full FAQs page and the Resources page were not captured, so these absences are from the 3 captured pages and not from the portal as a whole. A statement of what a search found, not a certified negative.
[26]
About APAAR (official portal About page, apaar.education.gov.in), Lifelong Academic Identity, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the portal's own description of APAAR under NEP 2020 and the NCrF, the 12 digit permanent ID assigned to every student, the 4 step registration process with parental consent for a minor and DigiLocker, and a data security paragraph that says information is shared only with necessary government agencies; a scheme description and not an instrument
APAAR assigns a unique and permanent 12-digit ID to every student, offering a comprehensive record of their academic achievements, including degrees, scholarships, awards, and other credits.
About page of apaar.education.gov.in, extraction line 21, captured 19 October 2026.
[27]
About APAAR (official portal About page, apaar.education.gov.in), How APAAR Works, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the portal's own description of APAAR under NEP 2020 and the NCrF, the 12 digit permanent ID assigned to every student, the 4 step registration process with parental consent for a minor and DigiLocker, and a data security paragraph that says information is shared only with necessary government agencies; a scheme description and not an instrument
Schools: Record and manage students' academic data, achievements, and activities in APAAR.
About page, extraction line 24: the school's role in the scheme's own description. Cited for who does what; it is not a statement of who the Data Fiduciary is.
[28]
About APAAR (official portal About page, apaar.education.gov.in), Data Security and Confidentiality, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the portal's own description of APAAR under NEP 2020 and the NCrF, the 12 digit permanent ID assigned to every student, the 4 step registration process with parental consent for a minor and DigiLocker, and a data security paragraph that says information is shared only with necessary government agencies; a scheme description and not an instrument
APAAR prioritizes data security and confidentiality, sharing information only with necessary government agencies for privacy and security.
About page, extraction line 34. The portal's own description of its sharing, which paragraph 9 of the order now bounds.
[29]
Terms of Use, APAAR (official portal page, apaar.education.gov.in), General Information, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the 1 portal page that states in words which ministry runs APAAR, a service provided by the Ministry of Education and implemented by Digital India Corporation under MeitY, and that carries the Aadhaar linking clause and the DigiLocker integration clause; platform terms and not an instrument
These Terms of Service ("Terms") constitute a legally binding agreement between you ("User”) and the Automated Permanent Academic Account Registry (APAAR), a service provided by the Ministry of Education, integrating with Academic Bank of Credits (hereafter referred to as the “ABC”), established by the Ministry of Education and University Grants Commission (hereby referred to as “MoE” and “UGC” respectively), implemented by Digital India Corporation (DIC), Ministry of Electronics and Information Technology (MeitY).
Terms of Use of apaar.education.gov.in, extraction line 16, captured 19 October 2026, reproduced with the page's own mixed quotation glyphs. The 1 of the 3 captured portal pages that names the Ministry of Education: run by the Ministry of Education, implemented by Digital India Corporation under MeitY.
[30]
Terms of Use, APAAR (official portal page, apaar.education.gov.in), Definitions, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the 1 portal page that states in words which ministry runs APAAR, a service provided by the Ministry of Education and implemented by Digital India Corporation under MeitY, and that carries the Aadhaar linking clause and the DigiLocker integration clause; platform terms and not an instrument
(b) “APAAR” : means Automated Permanent Academic Account Registry, a product of Ministry of Education, integrated with Academic Bank of Credits.
Definition (b) in the Terms of Use, extraction line 21 of the capture of 19 October 2026, the ground for this site's reading of which body decides why the ID exists.
[31]
Terms of Use, APAAR (official portal page, apaar.education.gov.in), User Submissions, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the 1 portal page that states in words which ministry runs APAAR, a service provided by the Ministry of Education and implemented by Digital India Corporation under MeitY, and that carries the Aadhaar linking clause and the DigiLocker integration clause; platform terms and not an instrument
By linking your Aadhaar number to your APAAR account, you grant APAAR, permission to use your unique identifier information for authentication and to retrieve your verification data from the UIDAI servers in order to provide the APAAR service.
Terms of Use, extraction line 43. The Terms frame Aadhaar linking as a permission the user grants; no legal basis for collecting the number is stated on any of the 3 captured portal pages; the Privacy Policy the Terms refer to at extraction line 75 was not captured. Cited as 1 of the 3 flows this page recommends be read against paragraph 9.
[32]
Terms of Use, APAAR (official portal page, apaar.education.gov.in), Data Protection and Security, p. 1. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 19 October 2026Document status: live official portal page, undated on its face, captured 19 October 2026; the 1 portal page that states in words which ministry runs APAAR, a service provided by the Ministry of Education and implemented by Digital India Corporation under MeitY, and that carries the Aadhaar linking clause and the DigiLocker integration clause; platform terms and not an instrument
By using APAAR, you agree to the collection, processing, and storage of your academic data in terms of the privacy policy. The Ministry follows industry-standard security measures to safeguard your information. For more details, please refer to the Privacy Policy available on the APAAR platform.
Terms of Use, extraction line 75, captured 19 October 2026. The Terms send the reader to the portal Privacy Policy for the collection, processing and storage of academic data. That Privacy Policy was not captured, nor were the full FAQs page or the Resources page, so every absence this page reports is from the 3 captured portal pages and not from the portal as a whole.
[33]
“Academic Bank of Credits and APAAR” (Press Information Bureau factsheet, id 150693) (Factsheet id 150693), p. 1. Published 4 July 2026. Official source ↗ · Official government statement, not a legal requirement · Verified 19 October 2026Document status: published official PIB factsheet, entry date 4 July 2026 on its face; it states that the Academic Bank of Credits is an initiative of the Ministry of Education regulated by UGC, that the APAAR ID is a 12 digit identifier linked to the ABC system and accessible through DigiLocker, that students receive the ID linked to their Aadhaar and DigiLocker account, and it carries the 2 July 2026 count of 26.35 crore verified APAAR IDs; a factsheet and not an instrument
16.62 (Cr.)
PIB Research factsheet Academic Bank of Credits and APAAR, entry date 4 July 2026, captured 19 October 2026: the School Education row of the progress table reported as on 2 July 2026, extraction lines 110 to 113, where the row reads School Education, (APAAR IDs in School), a dash, 16.62 (Cr.). The figure is read as 16.62 crore APAAR IDs in school education. The same factsheet's 26.35 crore verified IDs as at 2 July 2026 is a different measure from the portal counter and is not equated with it.
[34]
“Academic Bank of Credits and APAAR” (Press Information Bureau factsheet, id 150693) (Factsheet id 150693), p. 1. Published 4 July 2026. Official source ↗ · Official government statement, not a legal requirement · Verified 19 October 2026Document status: published official PIB factsheet, entry date 4 July 2026 on its face; it states that the Academic Bank of Credits is an initiative of the Ministry of Education regulated by UGC, that the APAAR ID is a 12 digit identifier linked to the ABC system and accessible through DigiLocker, that students receive the ID linked to their Aadhaar and DigiLocker account, and it carries the 2 July 2026 count of 26.35 crore verified APAAR IDs; a factsheet and not an instrument
All academic data remains within India’s sovereign digital infrastructure, and the platform is fully compliant with the Digital Personal Data Protection Act.
Extraction line 143, the 1 mention of the Act across the 4 official captures. It describes Blockchain for Digital Credentials, a Digital India Corporation platform, and not APAAR. It is PIB's assertion and never a finding. The Data Fiduciary obligations in sections 4, 5, 7 to 10 and section 6 except sub section (9) are in the 18 month group of G.S.R. 843(E), computed 13 May 2027, interpretation until officially confirmed.
[35]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(f), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 19 October 2026In force since 13 November 2025
“child” means an individual who has not completed the age of eighteen years
The definition of a child, Gazette page 2. In force since the printed publication date of 13 November 2025 under paragraph (a) of G.S.R. 843(E), which brought the whole of section 2 into force.
[36]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 19 October 2026In force since 13 November 2025
“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data
The defined term the order's lower case data fiduciaries points at, Gazette page 2. In force since 13 November 2025 with the rest of section 2.
[37]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(s), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 19 October 2026In force since 13 November 2025
“person” includes— ( i ) an individual; ( ii ) a Hindu undivided family; ( iii ) a company; ( iv ) a firm; ( v ) an association of persons or a body of individuals, whether incorporated or not; ( vi ) the State; and ( vii ) every artificial juristic person, not falling within any of the preceding sub-clauses
Clause (s) of section 2, Gazette page 3, reproduced with the spaced brackets of the Gazette print. Sub clause (vi) names the State; on this site's reading that allows a Ministry running an administrative scheme to be a Data Fiduciary under clause (i). In force since 13 November 2025 with the rest of section 2.
[38]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 19 October 2026In force since 13 November 2025
“personal data” means any data about an individual who is identifiable by or in relation to such data
The definition of personal data, Gazette page 3. Each of the 9 details the portal lists as mandatory for an APAAR ID is data about an identifiable individual on this site's reading. In force since 13 November 2025 with the rest of section 2.
[39]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 9(1), p. 8. Published 11 August 2023. Official source ↗ · Printed text, since modified by S.O. 5458(E); quoted as published · Verified 19 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Section 9(1) as printed in the 2023 Gazette, page 8. The Removal of Difficulties Order S.O. 5458(E), paragraph 2(i), cited separately as DPDP-RDO-2026, adds the word of before a person with disability, so the provision as modified reads any personal data of a child or of a person with disability who has a lawful guardian; that Order is owned by /blog/dpdp-removal-of-difficulties-order-2026. Section 9 is inside sections 7 to 10 in paragraph (c) of G.S.R. 843(E): not in force until 18 months after 13 November 2025, computed 13 May 2027, interpretation until officially confirmed. The 3 section 9 duties and the relief valves in sub sections (4) and (5) are owned by /blog/dpdp-childrens-data-rules.
[40]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 9(3), p. 8. Published 11 August 2023. Official source ↗ · Official requirement · Verified 19 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
Section 9(3), Gazette page 8, cited in 1 sentence as the provision nearest the petitioners' surveillance contention. It is a prohibition rather than a consent question, and its analysis, with Rule 12 and the Fourth Schedule, is owned by /blog/dpdp-childrens-data-rules and /blog/dpdp-for-schools-and-edtech. Same commencement as section 9(1).
[41]
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023). Published 11 August 2023. Official source ↗ · Interpretation, requires judgment · Verified 19 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entryThis site's reading of the order against the Act, labelled interpretation in the body: the definitions in section 2, in force since 13 November 2025, give the order's phrase data fiduciaries a meaning today while the duties attached to that status are not in force; the body that decides why the APAAR ID exists and what it collects, placed by the Terms of Use with the Ministry of Education, is on this reading the Data Fiduciary for the scheme; and a school that sets its own purposes for the data would be a Data Fiduciary for those on the split /blog/dpdp-for-schools-and-edtech carries. The order names no Data Fiduciary.
[42]
Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)), 2(i), p. 3. Published 6 October 2026. Official source ↗ · Official requirement · Verified 19 October 2026Document status: published; in force from the date of its publication in the Official Gazette
in section 9, in sub-section (1), for the words “ child or a person with disability,” the words “child or of a person with disability ”shall be substituted
Paragraph 2(i) of the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E) dated 5 October 2026, Gazette issue No. 5248 of 6 October 2026, page 3, quoted with the leading and trailing spaces inside the quotation marks as printed. Under its paragraph 1(2) the Order came into force on publication; it changes the wording of section 9(1) and not its commencement, which stays in the 18 month group computed 13 May 2027. The Order is owned by /blog/dpdp-removal-of-difficulties-order-2026.
[43]
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 10, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 19 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India, by reference to — (a) reliable details of identity and age of the individual available with the Data Fiduciary; or (b) details of identity and age, voluntarily provided — (i) by the individual; or (ii) through a virtual token mapped to such details, which is issued by an authorised entity.
The operative words of Rule 10(1), Gazette page 27 of issue No. 760, cited as the text an APAAR consent step will have to meet after commencement; the body quotes its opening words only. The 2 evidence paths, the authorised entity definition, the Digital Locker wording and the 4 illustrations are owned by /blog/what-is-verifiable-consent-dpdp and /blog/dpdp-childrens-data-rules and are not analysed here.
[44]
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 19 October 2026In force since 13 November 2025
Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.
Rule 10 and Rule 12 are inside rules 5 to 16, so the verifiable consent machinery and the Fourth Schedule exemptions are not in force until 18 months after 13 November 2025, computed 13 May 2027. Quoted with the closing words as corrected by corrigenda G.S.R. 892(E) of 10 December 2025, item (i)(b), which replaced of this Gazette with in the Official Gazette at line 24 of Gazette page 24; the print as first issued reads of this Gazette. Rule 1 itself is in force since publication under Rule 1(2). Rule 1(3) is the 1 year group and holds only Rule 4.
[45]
Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 19 October 2026Document status: published; in effect per its own terms
the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2, sections 18 to 26 sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44 of the said Act shall come into force
Paragraph (a) of G.S.R. 843(E), quoted as printed including the missing comma after 26. The words sub sections (1) and (3) are split across a line in the print, as "sub- sections", and are joined here, which is the join src/data/sources.json already records for this passage. It names section 2, so the definitions of child, Data Fiduciary, person and personal data have been in force since the printed publication date of 13 November 2025, and section 39 with them.
[46]
Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 19 October 2026Document status: published; in effect per its own terms
one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.
Paragraph (b) of G.S.R. 843(E), Gazette issue No. 757 page 2: section 6(9) and section 27(1)(d) commence 1 year from publication, computed 13 November 2026. On this site's reading, interpretation, neither touches the APAAR scheme; the notification does not say so. Cited so the 18 month statements on this page carve them out.
[47]
Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 19 October 2026Document status: published; in effect per its own terms
eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
Paragraph (c) of G.S.R. 843(E) of 13 November 2025, Gazette issue No. 757 page 2, reproduced as printed including the missing space after "section 6,". Sections 4 and 5 fall inside "sections 3 to 5", section 6 except sub section (9) is named, and sections 7, 8, 9 and 10 fall inside "sections 7 to 10", so every Data Fiduciary obligation the order's paragraph 8 points at is in this group; section 27 except clause (d) of sub section (1) is here too. Paragraph (b) puts sections 6(9) and 27(1)(d) at 1 year, computed 13 November 2026; on this site's reading, interpretation and not the notification's words, neither touches this scheme.
[48]
Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)). Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 19 October 2026Document status: published; in effect per its own termsThe calendar dates 13 November 2026 and 13 May 2027 are this site's computation of 1 year and 18 months from the publication date of 13 November 2025 printed on the masthead of Gazette issue No. 757, and are interpretation until officially confirmed, because the notification fixes a period and does not say how the period is counted. The eGazette file code on the same issue embeds 14112025, and the 1 day question is on /blog/dpdp-commencement-date-13-or-14-november; nothing on this page turns on it.

Every legal claim in this article traces to one of the documents below. The label on each says what that document is and what this site is doing with it. How we verify