The Right to Say No: APAAR, the Supreme Court’s Opt-Out Mandate, and the DPDP Framework for Student Data

By Anuradha Gandhi and Rishabh Gupta

Introduction

On July 20, 2026, a three-Judge Bench of the Hon’ble Supreme Court disposed of a writ petition under Article 32 of the Constitution challenging the constitutional validity of the Automated Permanent Academic Account Registry (“APAAR”) Scheme,  an initiative by the Ministry of Education that assigns every student an “Aadhaar-linked, Digital Academic Identifier”. While the Court declined to strike down or stay the Scheme, it issued a set of directions in line with the Digital Personal Data Protection Act (DPDP) 2023. The consent form for APAAR must now expressly permit parents and guardians to withhold or refuse consent and all processing under the Scheme remains fully subject to the DPDP Act thereby restricting sharing of student data with private entities or third parties except where permitted by law.[1]

The APAAR Scheme and the Dispute in Question

APAAR builds on the One Nation One Student ID (ONOSID) initiative and the UDISE+ database, seeking to create a unified, portable academic record for every student, linked to their Aadhaar number, that follows them from school admission through higher education and, potentially, employment. Enrolment is intended to be voluntary and contingent on parental consent.

For more information, kindly read our article: Introduction of APAAR ID: A Growing Privacy Concern

The petitioners i.e. parents of children in CBSE-affiliated schools contended that this design was compromised in practice[3]. Their principal grievances were:

1. The prescribed consent form did not allow parents to refuse participation; it collected Aadhaar details without a corresponding “no” option.
2. The form failed to disclose material particulars of processing — the purpose of collection, the retention period, downstream processing, and with whom the data would be shared.
3. Subsequent CBSE circulars, mandating APAAR registration as a precondition for Board examination enrolment from the 2026 academic session, rendered the ostensible consent illusory i.e. consent obtained under threat of losing access to a Board examination is not freely given.
4. Schools were reported to be linking APAAR/Aadhaar compliance to admission, examination registration and even institutional recognition or State funding, converting a supposedly optional scheme into a de facto mandatory one.

These facts framed three issues for the Court: (i) whether the Aadhaar-linked, lifelong educational database itself violated the fundamental right to privacy; (ii) whether the consent mechanism met the threshold of valid, informed and meaningful consent; and (iii) whether the personal information collected was adequately protected against misuse and unauthorised disclosure.

Judgement of the Hon’ble Supreme Court

The Bench declined to interfere with the operation of the Scheme itself. It did not find the Aadhaar-linked academic identifier, as such, constitutionally impermissible. However, it granted substantive relief on the consent architecture, adopting and extending the approach of the Orissa High Court in Rohit Anand Das v. State of Odisha[4], which had already directed inclusion of a refusal clause in the APAAR scheme within that State. The Supreme Court directed that those safeguards be implemented nationwide.

Key directions of the judgment:

1. Mandatory opt-out in the consent form. The model consent form must be amended to expressly give parents/guardians the option to withhold or refuse consent — not merely to sign a form that presumes participation.
2. DPDP Act governs the Scheme regardless of its administrative character. The Court clarified that concerns about misuse of student data were “misplaced” because processing under APAAR is fully governed by the DPDP Act notwithstanding that the Scheme itself rests on executive instruction rather than statute. Implementing authorities were directed to ensure strict compliance with the Act’s safeguards.
3. Restriction on third-party disclosure. Personal information collected under APAAR cannot be disclosed, shared or made available to any private entity or third party except in accordance with law and strictly for purposes authorised thereunder; any sharing beyond the Scheme, or for extraneous purposes, is impermissible.

Reading the Directions Through the DPDP Framework

The judgement reinforced the consent standards as prescribed under section of the DPDP Act, which the APAAR Consent form was failing to meet.

1. Consent as the lawful ground (Section4) – The DPDP Act requires consent to be collected before processing personal information. Since APAAR enrolment does not fall within any of the enumerated legitimate uses (such as processing by the State for benefits, subsidies or services, or compliance with law) in a manner that dispenses with consent for the Aadhaar-linked identifier, hence it must satisfy the consent standard prescribed under section 6 of the Act which requires consent to be free, specific, informed, unconditional, unambiguous and given through clear affirmative action.
2. Constitution of Clear-Affirmative Action (Section 6) – Section 6(1) requires consent to be free, specific, informed, unconditional, and unambiguous, signified by clear affirmative action. A form offering no mechanism to withhold consent cannot meet the “affirmative action”. Conditioning Board examination registration on enrolment compounds the defect, rendering consent neither free nor unconditional.
3. Retention and Deletion Protocols (Section 8) – Section 8(7) requires erasure of personal data once its purpose is served, or as soon as reasonably practicable after consent is withdrawn, unless retention is otherwise required by law. APAAR’s design as a lifelong academic record makes it difficult to fix a clear deletion trigger, risking indefinite storage. Authorities should specify a defined retention period, an automatic erasure workflow on withdrawal of consent, and periodic purging of data no longer necessary for the stated purpose.
4. Legacy Data – Educational institutions routinely retain academic, attendance, disciplinary, examination, scholarship and identity records long after a student has graduated. Where such records have been integrated into, or used for the creation of, APAAR profiles, it may result into continued processing of data without explicit consent. A prudent compliance approach would require schools and education authorities to identify legacy records that form part of the APAAR ecosystem, reassess the legal basis on which they are retained and processed, and provide an effective mechanism through which parents, guardians, or eligible students can review, withdraw consent for, or seek erasure of data that is no longer necessary for the purpose for which it was collected.

For more information on how student privacy is ensured in compliance with DPDP Act, kindly read our article: Ensuring Student Privacy in Education: Compliance with the Digital Personal Data Protection Act, 2023[5]

What should Educational Institutions do?

For the Ministry of Education, CBSE, State Boards and individual schools — each of whom functions as a Data Fiduciary (or, for schools, potentially as a joint fiduciary or processor depending on the contractual architecture with the Board) — the judgment translates into a discrete set of action items:

• Amend the model consent form including opt-opt options.
• Issue itemised privacy notice specifying the personal data processed and purpose
• Implement verifiable parental consent
• Decouple Board examination registration from APAAR enrolment
• Audit and restrict data-sharing arrangements with any third parties
• Establish an accessible grievance and correction mechanism
• Periodic review of security safeguards

For more information, kindly read our article: Schools, Coaching Centres and Platforms Processing Children’s Data: Are you Complaint?[6]

Conclusion

The Supreme Court’s ruling in Abhishek Baxi v. Union of India reinforces that APAAR implementation must comply with the DPDP Act by ensuring a clear opt-out mechanism, valid consent, and lawful data sharing. While limited in scope, it signals that courts will closely scrutinize consent frameworks and expect strict adherence to the DPDP Act, particularly in large-scale data processing involving minors. Educational institutions should adhere to these requirements and ensure that the collection, use, and disclosure of student data is carried out in compliance with the DPDP Act and the safeguards mandated by the Supreme Court.

[1] Abhishek Baxi v. Union of India, 2026 SCC OnLine SC 1391, decided on 20-7-2026]

[2] https://ssrana.in/articles/introduction-of-apaar-id-a-growing-privacy-concern/

[3] https://cdnbbsr.s3waas.gov.in/s3kv052ffce46d93d998e9a58d782a2997/uploads/2025/03/2025032630.pdf

[4] 2025 SCC OnLine Ori 4535

[5] https://ssrana.in/articles/ensuring-student-privacy-in-education-compliance-with-the-digital-personal-data-protection-act-2023/

[6] https://ssrana.in/articles/schools-coaching-centres-platforms-processing-childrens-data-are-you-compliant/