Consent, apaar and the dpdp act: Key Takeaways from the Supreme Court’s order

Authored by Ammu Brigit

BACKGROUND

On 20 July 2026, the Hon’ble Supreme Court of India disposed of a writ petition under Article 32 challenging the constitutional validity of the Automated Permanent Academic Account Registry (“APAAR”) Scheme. The Bench expressly held that the processing of personal data under APAAR is governed by the Digital Personal Data Protection Act, 2023 (“DPDP Act”), regardless of the fact that APAAR itself is an administrative scheme rather than a statutory one. The Supreme Court directed that the consent safeguards ordered for APAAR by the Orissa High Court in December 2025 now apply pan-India.

WHAT IS APAAR?

APAAR is a 12-digit lifelong student identification number introduced by the Ministry of Education under the National Education Policy, 2020, as part of its “One Nation, One Student ID” initiative. It is intended to remain constant from school through higher education, consolidating marksheets, credits and academic achievements in a digital record, and is linked to the Academic Bank of Credits to facilitate credit transfer between institutions. Generation of an APAAR ID requires linkage to the student’s Aadhaar number.

THE ORISSA HIGH COURT JUDGMENT

Rohit Anand Das & Anr. vs. State of Odisha & Ors., (W.P.(C) No. 8285 of 2025)

The petitioners were the father and kindergarten-going daughter. The school had written to the father in December 2024 asking him to submit a signed consent form along with a copy of the family’s Aadhaar card so that an APAAR ID could be generated for his daughter. The father objected, that the consent form gave no option to refuse consent or opt out, and having received no response from the school, filed a writ petition seeking a direction that the model consent form be amended to include such an option.

The State, the Union Ministry of Education, UIDAI and the school  cohesively took the position that APAAR enrolment was voluntary and that parents could decline. Taking the same into consideration, the Court agreed that the scheme was not in dispute as such but found that the model consent form did not reflect that voluntariness. It permitted withdrawal of consent only after the form had been submitted, with no clause allowing a parent to decline at the outset. Drawing on the Supreme Court’s 2019 decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, which held that children’s access to education cannot be made contingent on an Aadhaar card and that children’s privacy warrants special protection, the Court held that there is no option to refuse consent at the initial stage, and that a right of withdrawal exercisable only after consent has already been given could not substitute for a genuine right to refuse. The Court accordingly directed the concerned authorities to consider amending the model consent form to include an opt-out or refusal-of-consent clause, with necessary orders to follow within two months.

The Supreme Court’s Order

Abhishek Baxi & Ors. vs. Union of India & Ors.(W.P.(C) No. 832 of 2026)

This subsequent petition was filed by parents of students enrolled in CBSE-affiliated schools, who argued that APAAR functioned in practice as a mechanism for long-term tracking and profiling of children rather than a purely administrative convenience, and that they had communicated their refusal to consent to their respective schools. The petitioner’s counsel submitted that the model consent form neither offered an option to decline nor clearly disclosed the purpose, retention period or data-sharing practices attached to the information collected and also pointed to two CBSE circulars dated 5 August 2025 and 27 August 2025 which made generation of an APAAR ID a mandatory precondition for registering students of Classes IX to XII for Board examinations from the 2026 academic session onward.

The Supreme Court adopted the Orissa High Court’s approach, directing that the consent-form safeguard ordered in that case be given effect on a pan-India basis by all authorities implementing APAAR. The Court clarified that concerns about misuse of the data of those who do voluntarily enrol are not answered simply because APAAR is an administrative scheme rather than a statutory one. The collection, processing, storage, retention, sharing and use of personal information under APAAR is strictly governed by the provisions of the Digital Personal Data Protection Act, 2023.. The Court further directed that information collected under the scheme cannot be disclosed or shared with any private entity or third party except in accordance with law and strictly for authorised purposes. The petition was disposed of in these terms with liberty granted to the respondents to seek clarification if required.

The above clarification by Hon’ble Supreme Court is worth analysing. Statutory schemes can, in certain circumstances, process personal data without consent at all, relying on the DPDP Act’s “state function under law” exemption, a shortcut available only where the underlying scheme is backed by an actual law. APAAR has no such statute behind it, and it rests on Ministry circulars and policy. The said exemption was therefore never available to it, which meant consent was always the only lawful basis on which APAAR data could be collected.

The Supreme Court’s clarification means that DPDP obligations of lawful basis, purpose limitation, data-fiduciary accountability, restrictions on third-party sharing- apply to any processing of student personal data obtained by an institution, whether it arises under a government scheme, a Board circular, or the institution’s own internal policy. An institution cannot treat a process as outside the DPDP Act merely because it is administrative rather than statutory in origin and cannot rely on a “voluntary” label where downstream requirements (such as making an ID a precondition for examination registration) render participation compulsory in substance.

Key Takeaways and recommended steps for Education Institutions

The Supreme Court’s order carries several practical implications for the sector. A right to withdraw consent after enrolment is not a substitute for a genuine right to decline before enrolment, and consent design that defaults to “opt-out later” is unlikely to withstand scrutiny of the kind applied to the APAAR form. Where a Board or institution makes an ostensibly voluntary requirement, a practical precondition for an unrelated benefit, courts are prepared to treat the resulting consent as compelled rather than free, defeating its validity under the DPDP Act regardless of how the scheme is formally labelled.

Institutions would be well placed to begin by auditing existing consent forms and processes across admissions, biometric attendance, transport, hostel administration and ed-tech platforms to confirm that consent is genuinely optional, specific and separable from the underlying service, and to check whether any of these processes make a nominally voluntary step a precondition for an unrelated benefit, as the CBSE circulars did with examination registration. Privacy notices should be revised to plainly state the purpose of collection, the extent of use, the retention period, and any third parties with whom data is shared, and a documented mechanism should be put in place for parents or guardians to grant, refuse and withdraw consent, and to seek access, correction or erasure of a child’s data.

Institutions should also review data-sharing arrangements with vendors, examination boards and other third parties to confirm that no personal data moves outside the institution except strictly for authorised purposes. Institutions should assign clear ownership for DPDP compliance generally, including breach-response protocols and engagement with the Data Protection Board where required. Given that the Supreme Court’s order leaves the respondents at liberty to seek clarification, institutions should also watch for any follow-on proceedings that may further define CBSE’s and schools’ specific compliance obligations.