Blogs
Supreme Court Mandates Pan-India Parental Opt-Out and DPDP Act Compliance in APAAR Scheme: Analyzing Abhishek Baxi v. Union of India (2026)
Supreme Court Mandates Pan-India Parental Opt-Out and DPDP Act Compliance in APAAR Scheme: Analyzing Abhishek Baxi v. Union of India (2026)
In a milestone ruling safeguarding the constitutional right to privacy for minors, a three-judge Bench of the Supreme Court of India—led by Chief Justice Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohana—issued binding directives to the Central Government and the Central Board of Secondary Education (CBSE). In Abhishek Baxi v. Union of India (2026 LiveLaw (SC) 719), the apex court ordered the immediate modification of the model consent form prescribed under the Automated Permanent Academic Account Registry (APAAR) scheme across India. The judgment establishes that parental consent for digital educational IDs must be genuine, voluntary, and informed, while strictly prohibiting the unauthorized transfer or commercial disclosure of student data to third parties. Key Judicial Directives: The Legal Breakdown 1. Mandatory Pan-India Inclusion of the "Opt-Out / Refusal" Clause The petitioners challenged the APAAR scheme—introduced via administrative circulars—on the grounds that it created a de facto compulsory digital identity linked to Aadhaar for students appearing in Classes IX to XII Board examinations. Expanding the territorial application of the precedent laid down by the Orissa High Court in Rohit Anand Das v. State of Odisha (2025), the Supreme Court directed that paragraph 19 of the Orissa HC ruling must be enforced on a Pan-India basis. "We are of the considered view that such a safeguard is essential to ensure that the requirement of consent is meaningful and informed." — Chief Justice Surya Kant Educational authorities must now ensure that model consent forms explicitly provide parents or legal guardians with an unambiguous option to withhold or refuse consent without compromising a student's academic standing or eligibility for public board examinations. 2. Strict Adherence to Data Fiduciary Obligations under the DPDP Act, 2023 Addressing the constitutional challenge rooted in fundamental privacy rights under Article 21 (Justice K.S. Puttaswamy (Retd.) v. Union of India), the Supreme Court affirmed that administrative academic registries cannot bypass statutory data protection framework obligations. The Court explicitly held that any collection, storage, processing, or retention of student data under the APAAR scheme constitutes an act of a Data Fiduciary and must strictly comply with the obligations under the Digital Personal Data Protection Act, 2023 (DPDP Act). Purpose Limitation: Academic data collected strictly for institutional monitoring (e.g., curriculum tracking, teacher-student ratios) cannot be repurposed. Storage Limitation: Long-term retention and continuous digital profiling of minors must satisfy the tests of statutory necessity and proportionality. 3. Absolute Prohibition on Commercial & Third-Party Data Disclosures Recognizing the prospective risks of profiling and unauthorized commercial surveillance, the Bench placed a strict legal bar on the exposure of personal educational records to private entities. "It goes without saying that any personal information collected pursuant to the APAAR Scheme cannot be disclosed, shared, or otherwise made available to any private entity or third party except in accordance with law... Any sharing of such information beyond the scope of the Scheme or for extraneous purposes shall be impermissible." — Supreme Court of India Institutional Significance for Educational Entities & Data Fiduciaries This judgment serves as a precedent for educational institutions, EdTech platforms, and public sector undertakings handling data belonging to minors: Revision of Digital Onboarding Forms: All school management boards, administrative bodies, and affiliated institutions must immediately update their digital and physical admission, registration, and academic consent forms to incorporate informed opt-out choices. DPDP Compliance Audits: Educational bodies acting as Data Fiduciaries must implement institutional technical controls, role-based access management, and strict encryption measures to prevent data leakages to third-party EdTech vendors. De-Linking Mandatory Aadhaar Mandates: In line with established constitutional jurisprudence, access to public education and national examinations cannot be made contingent upon forced Aadhaar-based digital enrolments for children. Strategic Legal Advisory at BNG Law Associates At BNG Law Associates, backed by 15+ years of litigation expertise in commercial, institutional, and constitutional law, our practice provides panel-grade advisory for corporations, educational bodies, and High-Net-Worth Individuals (HNIs): Regulatory Compliance & Data Protection: Tailored audits under the Digital Personal Data Protection Act, 2023 (DPDP) for corporate entities, tech platforms, and institutions. Constitutional & Commercial Litigation: High-stakes writ petitions, commercial dispute resolution, and appellate advocacy before the Supreme Court of India and High Courts across PAN India. Tech-Enabled Remote Advisory for NRIs: Seamless virtual consultations (Zoom/Teams) for international clients handling complex regulatory, real estate, and institutional disputes in India.
