Child and Guardian Privacy

Draft status

This page is a draft for review. It has not been approved. It is not a final policy, and it does not create a legal commitment that has not been written down here. Version draft-2026-10-28.

The Digital Personal Data Protection Act, 2023 (22 of 2023) did not start in full on the day it was enacted. Ministry of Electronics and Information Technology notification G.S.R. 843(E), dated 13 November 2025, appoints different provisions on different dates. Definitions and the provisions listed for the date of that notification are the ones brought in on publication. Consent-manager provisions are appointed for one year after publication. Notice, consent, security safeguards, personal-data rights, children's-data duties, penalties, and the remaining substantive duties are appointed for eighteen months after publication. The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) use the same staged commencement. This draft does not treat a provision as already in force unless that notification has brought it in. Reviewers should read the gazette text rather than this summary.

Maktab student information

A Maktab is the education area of the product. Student names, classes, attendance, assessments, and guardian contacts are intended to stay inside that workspace. They are not fields on the public mosque directory.

A live student register is not running on the public site. Screens that show a student directory in a layout preview are samples and say so. This draft does not describe a collection that the public site is not performing.

Guardian verification

The procedure for checking that an adult is the guardian of a student is [Not recorded: guardian verification procedure]. Until that procedure exists, the product must not invent a guardian-to-student link.

Verifiable parental consent under the Digital Personal Data Protection Act and Rules is part of the children's-data provisions appointed for eighteen months after 13 November 2025. This draft does not claim that those rules are already in force, and it does not claim that a verifiable-consent flow has been built.

Authorized educational access

The intended rule is that student information is visible to people authorized inside the Maktab workspace, not to the public and not to an unrelated mosque tenant. The exact roles for teachers and guardians are [Not recorded: authorized educational roles].

Public disclosure

Student and guardian details are not published on the homepage, the directory, or these legal pages. Do not put a child's contact details, location, or school record into a public field.

Retention

How long student and guardian records would be kept is [Not recorded: child data retention period].

Requests about a child's information

A parent, guardian, or other person can use the contact form and choose the child-information category. The request is stored with the name, email, and message they submit.

Who is allowed to make that request, and what proof is required, is [Not recorded: who may request child information]. The form does not by itself verify guardianship.

Other child-protection laws may already apply apart from the Digital Personal Data Protection Act. A completed review of those laws is [Not recorded: child-protection legal review].