Data Privacy for Training Provider Platforms: GDPR and India’s DPDP Act
If your training platform holds data about learners in the EU or India, both the GDPR and the DPDP Act can apply to you, wherever your company sits. The GDPR already applies. India’s DPDP Act is only partly in force as of November 2026, and its main duties are scheduled to start in May 2027.
This guide is for operations heads, product leads and CTOs at companies that run instructor-led and virtual classes. It compares what each law says on consent, notices, children, retention, processors, breaches, transfers and penalties, quoting the official texts.
This is general information, not legal advice. Have qualified counsel confirm the dates and readings below before you act on them.
Key takeaways
- The DPDP Act is partly in force: most duties are scheduled for about 13 May 2027 unless the Government amends the dates.
- The DPDP Act has no general “legitimate interests” ground and no contract ground, so consent or one of nine listed uses must cover each use of learner data.
- A learner under 18 is a child under the DPDP Act, while the GDPR’s consent rule turns at 16 by default.
- Decide per data flow whether you are the controller (Data Fiduciary) or the processor, and put the processor terms in writing.
Which parts of the DPDP Act are in force as of November 2026?
As of November 2026, the DPDP Act is partly in force. The Data Protection Board provisions and administrative rules took effect in November 2025. Consent manager registration follows on 13 November 2026. The main duties on notice, consent, security, breach reporting and children are scheduled for about 13 May 2027.
The Act received assent on 11 August 2023. The Government notified the Digital Personal Data Protection Rules, 2025 as G.S.R. 846(E), dated 13 November 2025. A Press Information Bureau release announced them on 14 November, so some sources use that date.
- 13 November 2025: Rule 1(2) says “Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette.”
- 13 November 2026: Rule 4, consent manager registration, one year after publication (Rule 1(3)). It matters mainly to would-be consent managers.
- About 13 May 2027: Rules 3, 5 to 16, 22 and 23, eighteen months after publication (Rule 1(4)). The Act’s own duties follow the same schedule under a separate commencement notification, G.S.R. 843(E).
In January 2026, the Ministry of Electronics and Information Technology reportedly proposed cutting the eighteen months to twelve. In the latest sources available in October 2026, no amendment had been gazetted. Plan for May 2027, and recheck the Gazette each quarter.
Do GDPR and the DPDP Act apply to a training provider outside the EU and India?
Yes, both can. The GDPR applies to organizations established in the EU and to those offering goods or services to people in the EU. The DPDP Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.
The GDPR reaches “the offering of goods or services” to data subjects in the Union “irrespective of whether a payment of the data subject is required” (Art. 3(2)(a)). DPDP section 3(b) covers processing outside India “in connection with any activity related to offering of goods or services” to Data Principals in India.
One DPDP detail matters for classrooms: it covers data collected “in non-digital form and digitised subsequently”. A paper sign-in sheet typed into your platform is in scope once digitized.
How do GDPR and the DPDP Act compare side by side?
The two laws share a core: tell people what you do, use data for stated purposes, protect it, and answer for your processors. They differ on lawful bases, the age of a child, breach thresholds and fine structure. This table sets the provisions that matter most to a training platform next to each other.
| Topic | GDPR (Regulation (EU) 2016/679) | DPDP Act 2023 and Rules 2025 |
|---|---|---|
| Consent and lawful bases | Six bases in Art. 6(1), including contract, legal obligation and legitimate interests. Consent is “freely given, specific, informed and unambiguous” (Art. 4(11)). | Consent, or the “certain legitimate uses” in s. 7 (nine items, such as voluntarily provided data, legal obligation and employment). Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (s. 6(1)). |
| Notice | Art. 13 lists what to tell people: controller identity, purposes, legal basis, recipients, transfers, storage period. | A notice must accompany or precede each consent request (s. 5(1)). Rule 3: “understandable independently of any other information.” |
| Children | Consent is lawful “where the child is at least 16 years old” (Art. 8(1)), otherwise a parent or guardian must give or authorize it. Member States may lower the age, not below 13. | A child is under 18 (s. 2(f)). Verifiable parental or guardian consent first (s. 9(1), Rule 10). No tracking or behavioral monitoring (s. 9(3)), subject to Fourth Schedule exemptions. |
| Retention | “for no longer than is necessary for the purposes for which the personal data are processed” (Art. 5(1)(e)). | Erase on withdrawal of consent, or once it is reasonable to assume the purpose is no longer served, unless a law requires retention (s. 8(7)). Rule 8 fixed periods cover only named large platforms. |
| Processors | Use processors giving “sufficient guarantees” (Art. 28(1)), under a binding contract (Art. 28(3)). | Fiduciary stays responsible “irrespective of any agreement to the contrary” (s. 8(1)); a processor may be used “only under a valid contract” (s. 8(2)). |
| Breach notification | Authority notified “not later than 72 hours after having become aware of it”, unless unlikely to risk people’s rights (Art. 33(1)). Processor tells controller without undue delay (Art. 33(2)). | Board and each affected person (s. 8(6)). Rule 7: the Board “without delay”, then a report “within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow”. |
| Cross-border transfers | Allowed “only if” the Chapter V conditions are met (Art. 44). | Government may restrict transfers to notified countries (s. 16(1)). Rule 15 lets it set requirements for making data available to a foreign State or its agencies. |
| Penalties | Up to EUR 10 million or 2% of worldwide annual turnover (Art. 83(4)); EUR 20 million or 4% (Art. 83(5)); “whichever is higher”. | Caps: Rs 250 crore for failing security safeguards; Rs 200 crore for breach-notice or children’s-data failures; Rs 150 crore for Significant Data Fiduciary duties; Rs 50 crore otherwise. |
One crore is ten million, so Rs 250 crore is 2.5 billion rupees. Three contrasts shape platform design: the DPDP Act has no legitimate-interests or contract ground, its breach section as written has no risk threshold, and its caps are fixed sums, not percentages of turnover.
Are you a controller or a processor when you train a client’s employees?
It depends on who decides why and how the data is used. If you decide the purposes, you are a controller (GDPR) or Data Fiduciary (DPDP). If you handle data only on a client’s behalf, you are a processor. Many training providers are both, for different data flows.
The GDPR defines a controller as one who “determines the purposes and means of the processing” and a processor as one who “processes personal data on behalf of the controller”. The DPDP Act uses near-identical wording for a Data Fiduciary and a Data Processor.
Take two flows. A learner buys a public course on your storefront: you choose what to collect, so you are likely the controller or fiduciary. A corporate client uploads its staff roster and wants completion reports: the client usually decides the purpose, so you are often its processor, while still a controller for your own billing and analytics. Counsel should confirm each case.
The contract matters in both regimes. Article 28(3)(a) requires a processor to act “only on documented instructions from the controller”, and 28(3)(g) requires deleting or returning data when services end.
Pro tip: Map roles per data flow. Keep a one-page table with a row for each flow (storefront buyers, client rosters, trainer records, marketing lists), naming who decides the purpose and who processes. It settles contract wording and tells you whose notice and consent apply.
What should consent and notice look like on a registration form?
Show a plain-language notice before or with the consent request, state each purpose, and keep optional uses such as marketing separate from required ones. Make withdrawal as easy as agreeing, and keep a record of what each person saw and when.
Both laws set the bar on withdrawal. GDPR Article 7(3): “It shall be as easy to withdraw as to give consent.” DPDP section 6(4) uses “the ease of doing so being comparable to the ease with which such consent was given”. Under Article 7(1), the controller “shall be able to demonstrate” consent.
Bundling is where platforms slip. GDPR Article 7(4) looks at whether a service is “conditional on consent to the processing of personal data that is not necessary” for it, and DPDP section 6(1) asks for consent that is “unconditional”. Making newsletter consent a condition of enrolling is hard to defend under either text.
The footing also differs. Under the GDPR, enrolment can rest on contract, so consent covers only optional uses. The DPDP Act’s list of legitimate uses has no contract ground, so counsel must say which basis covers each step. DPDP notices must also explain how to withdraw, exercise rights and complain to the Board (s. 5(1)).
How should a platform treat learners who are minors?
Treat anyone under 18 as a child for DPDP purposes and collect verifiable parental or guardian consent first. Under the GDPR, the consent rule turns at 16 by default, and Member States can lower it to 13. Adult-only providers can add an age check at registration instead.
Youth programs, school-holiday courses and apprenticeships bring minors onto platforms built for adults. DPDP section 9(1) requires the fiduciary to “obtain verifiable consent of the parent of such child or the lawful guardian”, and Rule 10(1) asks for due diligence that the person claiming to be the parent is an adult.
Section 9(3) bars “tracking or behavioural monitoring of children or targeted advertising directed at children”. The Fourth Schedule exempts “A Data Fiduciary who is an educational institution”, but only where “Processing is restricted to tracking and behavioural monitoring” for its educational activities or the safety of enrolled children. Whether a commercial training company counts as an educational institution is a question for counsel.
How long can a platform keep learner records?
Keep each record only as long as its purpose needs it, unless a law requires longer, then erase it and make your processors erase it too. Both laws say this. The practical work is assigning a retention clock to every data object on your platform.
DPDP section 8(7) requires erasure “upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served”, and the fiduciary must “cause its Data Processor to erase” the data. Rule 8 and the Third Schedule set a three-year inactivity period only for e-commerce entities and social media intermediaries with at least two crore registered users, and gaming intermediaries with at least fifty lakh. Rule 8(3) separately requires keeping certain logs for at least a year for listed purposes.
| Platform record | Question to settle before setting its retention clock |
|---|---|
| Registration profile | After how long without activity do you erase it or ask the learner to confirm? |
| Attendance and assessment results | Which law, accreditor or client contract sets a minimum retention period? |
| Payment and invoice data | What do tax and accounting rules require in each country you sell in? |
| Virtual class recordings | Is there a stated purpose after the session ends, and does the learner know? |
| Marketing contacts | Where is the withdrawal list, and does every system respect it? |
What must you do when a learner data breach happens?
Start a clock the moment you become aware. Under the GDPR, notify the supervisory authority within 72 hours where feasible, unless the breach is unlikely to risk people’s rights. Under the DPDP Rules, tell the Board without delay, send a fuller report within 72 hours, and inform each affected person.
GDPR Article 33(1) adds that a late notice “shall be accompanied by reasons for the delay”, and Article 33(2) requires the processor to notify the controller “without undue delay”. Rule 7(1) asks for notice to people in “a concise, clear and plain manner and without delay”.
Multi-client platforms face a practical problem: finding which learners in which client workspace were affected. If your logs cannot answer that within hours, a 72-hour window will be tight under either law.
Pro tip: Rehearse the clock. Pick a client workspace, assume its learner export leaked, and time how long it takes to list affected learners, name the data fields and reach the client. Put a number of hours, not “promptly”, in every processor contract.
What should a platform team build or check before May 2027?
Start with the data model, because most duties land there: roles, consent records, retention clocks and logs. These six steps turn the points above into engineering work, and each needs a counsel review before you call it done.
- Map every data object, who decides its purpose, and where it is stored, including subprocessors.
- Split registration consent from marketing consent, and store the notice version each learner saw.
- Assign a retention clock to each record, with erasure jobs that also reach processors.
- Write a breach runbook with a 72-hour timeline and processor notification hours.
- Add an age check and a guardian-consent path if you serve anyone under 18.
- Watch Government orders under section 16 and Rule 15 for limits on where data may go.
What should you do next?
Book a legal read of this checklist with a lawyer who knows both regimes, and bring your data map and role table. Ask about the open points above: whether you count as an educational institution, which DPDP basis covers enrolment, and whether the May 2027 date has moved.
When you compare platforms, ask every vendor for data processing terms, a subprocessor list and breach-notice commitments in writing. Mundrisoft builds SimpliTrain, and its page for professional training companies says “Client data, learner records, and course content are separated at the access control level”. That page does not state GDPR or DPDP compliance, so ask for those terms directly.
Teams weighing a custom build can read Mundrisoft’s overview of custom enterprise LMS platforms, then bring this checklist to the design stage, since retention clocks, role separation and breach logging all touch the data model.
Frequently asked questions
Is the DPDP Act in force yet?
Partly. The Rules were published on 13 November 2025, which brought the Board provisions and administrative rules into force. Consent manager registration follows on 13 November 2026. Most duties on notice, consent, security, breaches and children are scheduled for about 13 May 2027. A shorter timeline was proposed in January 2026, so check the Gazette.
Does the DPDP Act apply to a training company outside India?
It can. Section 3(b) covers processing outside India when it is connected with offering goods or services to people in India. A company abroad that sells courses to learners in India should assume the Act reaches that data, and have counsel confirm how, particularly once the main duties start in 2027.
Does the DPDP Act have a legitimate interests ground like the GDPR?
Not in the text. Section 4(1) allows processing on consent or for the “certain legitimate uses” in section 7. Those nine uses include voluntarily provided data, legal obligations, medical emergencies and employment. There is no general ground for an organization’s own legitimate interests and no contract ground, so consent carries more weight.
How quickly must a data breach be reported?
Under the GDPR, to the supervisory authority within 72 hours where feasible, unless the breach is unlikely to risk people’s rights. Under DPDP Rule 7, to the Board without delay, with a fuller report within 72 hours or a longer period the Board allows, and to each affected person without delay.
At what age is a learner a child under each law?
Under the DPDP Act, anyone who has not completed eighteen years. Under the GDPR, Article 8 sets the age for consent to online services offered directly to children at 16 by default. Member States may lower it, but not below 13. The two ages answer slightly different questions, so check both for youth programs.