Making APAAR Consent Meaningful: Supreme Court’s Directions

Introduction

The Supreme Court’s July 2026 directions concerning the Automated Permanent Academic Account Registry, commonly known as APAAR, have transformed the legal and administrative conditions under which the scheme may operate. The Court did not strike down APAAR. Instead, it required changes to the consent mechanism and clarified that the collection, processing, retention and sharing of student information must comply with the Digital Personal Data Protection Act 2023.

The Court directed the Union Government, the Central Board of Secondary Education and other authorities implementing APAAR to give effect across India to safeguards earlier directed by the Orissa High Court. The model consent form must expressly allow parents or guardians to withhold or refuse consent, and the scheme must not make participation practically compulsory by attaching educational disadvantages to refusal.

The directions matter because APAAR creates a lifelong digital academic identity for students. A system that connects a student’s educational history across institutions may simplify transfers, scholarships, examinations and recognition of qualifications. But it also concentrates extensive information in a linked digital record. Where the student is a minor and the identifier is connected with Aadhaar, consent must be more than a signature obtained through institutional pressure. It must be informed, voluntary and capable of refusal.

Understanding the APAAR Scheme

APAAR stands for Automated Permanent Academic Account Registry. It was introduced as part of the National Education Policy 2020 and the “One Nation, One Student ID” framework. The scheme assigns a unique lifelong academic identifier to a student and is intended to allow educational records to move with the student across institutions.

The proposed academic record may include marksheets, certificates, credits, qualifications and co-curricular achievements. It is connected with digital platforms such as the Academic Bank of Credits and DigiLocker, allowing records to be authenticated and accessed for educational or administrative purposes.

The rationale is practical. Students frequently move between schools, boards, colleges and vocational institutions. Physical records may be lost, forged or difficult to verify. A digital academic identity can reduce duplication, simplify admissions and support the transfer of academic credits. It may also help students obtain certificates and access scholarships or employment-related documentation.

However, the system creates a permanent or long-term data trail beginning during childhood. The information may reveal a student’s educational history, performance, institutional affiliations and other personal details. If combined with Aadhaar or other identifiers, the consequences of unauthorised access or inaccurate records become more serious.

The legal question is therefore not whether digitisation is beneficial in general. It is whether the State has designed the system so that the benefits are achieved without making students surrender control over their personal information through an effectively compulsory process.

The Supreme Court’s Directions

The Supreme Court directed that the consent-form safeguards identified by the Orissa High Court be implemented on a pan-India basis. The model form must expressly enable a parent or guardian to refuse or withhold consent for the creation of an APAAR ID. The direction is important because a general statement that participation is voluntary may be insufficient where the form contains no visible refusal option or where schools communicate that the ID is necessary for examinations, admission or progression.

The Court also made clear that all collection, processing, storage, retention, sharing and use of personal information under APAAR is governed by the DPDP Act 2023. The fact that APAAR is an administrative scheme rather than a statute does not remove data-protection obligations. Government authorities implementing the scheme remain subject to the responsibilities applicable to Data Fiduciaries.

The Court further directed that information collected under APAAR cannot be disclosed or made available to private entities or third parties except in accordance with law and for authorised purposes. This limits the possibility that an academic database may become available for commercial profiling, targeted advertising, unauthorised analytics or unrelated data-sharing arrangements.

The directions therefore operate at three levels. They protect choice by requiring a real opt-out. They protect legality by applying the DPDP Act to the entire data lifecycle. They protect purpose limitation by restricting third-party disclosure.

Why Consent Must Be Voluntary

Consent is meaningful only if refusal is realistically possible. In a school environment, parents may sign a form because they believe that refusal will affect their child’s examination registration, admission, scholarship or academic record. Students may also feel unable to question an institution that presents the form as mandatory.

The Supreme Court’s direction addresses this risk by requiring an express option to withhold or refuse consent. A form that provides only a signature line is not neutral. It converts participation into the default and makes refusal administratively burdensome. The design of the form must communicate that the parent or guardian has a genuine choice.

Voluntariness also requires the absence of coercive consequences. If students who refuse APAAR are denied access to examinations or educational services, consent becomes functionally compulsory. The State may pursue legitimate educational objectives, but it must demonstrate why a permanent digital identifier is necessary for the particular service and whether a less intrusive alternative exists.

The requirement is especially important because children may not be able to evaluate the long-term consequences of data collection. Parental consent is intended to provide protection, not merely to transfer the burden of decision-making to a formality. Parents must receive understandable information about what is collected, why it is collected, who may access it and how consent may be withdrawn.

DPDP Act and Student Data

The DPDP Act requires a Data Fiduciary to process personal data for a lawful purpose and to provide notice concerning the data and processing activity. In the APAAR context, the notice should identify the categories of academic and identity information collected, the purpose of linking records, the storage arrangements, the authorities with access and the circumstances in which data may be shared.

The Act recognises consent as one basis for processing, but consent must be free, specific, informed and unambiguous. The APAAR form must therefore avoid vague language authorising all future uses of student information. Consent for creating an academic record should not automatically become consent for unrelated research, commercial analytics, advertising or profiling.

The Data Fiduciary must also take reasonable security safeguards and respond to personal-data breaches. For APAAR, safeguards should include access controls, authentication, encryption, audit trails, role-based permissions and procedures for correcting inaccurate records. Since the database may contain information about minors, the consequences of weak security are particularly serious.

The DPDP Act also imposes obligations concerning erasure when the purpose for retention is no longer served, subject to legal requirements. A lifelong academic identifier may justify extended retention of verified academic records, but indefinite retention of every associated data point is not automatically necessary. The authorities should distinguish permanent academic credentials from temporary operational data, access logs and unnecessary metadata.

Aadhaar Linkage and Data Minimisation

The Aadhaar linkage raises a separate proportionality concern. Linking academic records to a widely used identity number may reduce duplication and improve authentication, but it also increases the consequences of data leakage and creates a more comprehensive profile of the student.

The authorities must therefore ask whether Aadhaar is necessary for each APAAR function or whether alternative verification methods can achieve the same purpose with less data exposure. The principle of data minimisation requires collection of data that is adequate, relevant and limited to what is necessary for the stated purpose.

A student may need an authenticated academic record without every institution receiving access to the student’s full identity profile. The system should use access segmentation so that an institution receives only the records necessary for the particular transaction. A university verifying a certificate may not need access to unrelated school records or co-curricular information.

Technical design is therefore part of legal compliance. Privacy cannot be protected only through a consent document if the architecture permits unrestricted access after consent is obtained.

Third-Party Sharing

The Supreme Court’s restriction on disclosure to private entities and third parties is directed at preventing secondary uses that are unrelated to education. A database containing academic performance may be valuable to recruiters, ed-tech companies, lenders, advertisers and data-analytics businesses. Uncontrolled access could lead to profiling and discrimination.

The restriction does not necessarily prevent every lawful sharing arrangement. A processor may need access to data to provide a technical service, but that access must be authorised, limited and governed by appropriate safeguards. The processor should not use the data for its own purposes or combine it with unrelated datasets.

The authorities must also explain whether data is shared with state governments, educational boards, scholarship agencies, examination bodies or foreign institutions. Each transfer should have a defined purpose, legal basis, access restriction and retention period. Students and parents should not be left to infer these arrangements from general policy documents.

Correction, Withdrawal and Grievance Redressal

A permanent academic record is valuable only if it is accurate. The APAAR framework must provide an accessible mechanism to correct errors in names, dates of birth, marks, credits, qualifications and institutional records. An incorrect digital entry can follow a student across educational institutions and affect future opportunities.

The DPDP Act provides rights and obligations concerning access, correction and grievance redressal. The system should identify which authority is responsible for correcting a particular category of information. A parent should not be required to approach multiple institutions without knowing which entity controls the record.

Withdrawal of consent must also be meaningful. If a parent refuses or withdraws consent, authorities should explain what happens to existing records, whether the APAAR ID is deactivated, whether records are deleted or retained under a legal obligation and how the student can continue accessing educational services through alternative means.

Why the Amendments Were Necessary

The amendments were necessary because the original consent structure risked confusing administrative convenience with lawful consent. If a form does not include an express refusal option, or if participation is tied to essential educational services, the formal existence of consent does not establish that the choice was free.

The amendments also recognise that privacy protection must operate throughout the data lifecycle. Consent at the collection stage cannot justify unrestricted retention, sharing or secondary use years later. Applying the DPDP Act to collection, processing, storage, retention and disclosure creates a continuing framework of accountability.

The Court’s directions further address the constitutional dimension of informational privacy. The Supreme Court has recognised privacy as a fundamental right under Article 21 in Justice KS Puttaswamy (Retd) v Union of India. A government programme involving children’s identity and educational data must therefore satisfy legality, legitimate purpose, necessity and proportionality.¹²

The aim is not to prevent digital education reform. It is to ensure that the State’s pursuit of administrative efficiency does not produce a system in which minors and parents have no meaningful control over a lifelong identity record.

Conclusion

The Supreme Court’s APAAR directions do not reject the objective of a unified digital academic identity. They require that the scheme operate through meaningful consent and data-protection safeguards. The model consent form must expressly permit parents or guardians to refuse participation, implementation must remain genuinely voluntary and all processing must comply with the DPDP Act, 2023.

The directions are necessary because APAAR involves a lifelong record beginning during childhood, potentially linked with Aadhaar and accessible across multiple institutions. Such a system can improve portability and authenticity of academic records, but it can also create lasting privacy, security and profiling risks.

The revised framework must therefore combine legal safeguards with privacy-conscious design. Data should be minimised, access should be limited, third-party disclosure should be controlled, inaccurate records should be correctable and withdrawal should not deprive students of essential educational services. The broader principle is that digital public infrastructure must be designed around individual autonomy. Administrative convenience cannot substitute for informed and voluntary consent.

Footnotes

^{1 Supreme Court of India, order dated 20 July 2026 in proceedings concerning the APAAR Scheme, Rohit Anand Das v State of Odisha and connected matters (sci.gov)}

^{2 Ministry of Education, Government of India, ‘APAAR: One Nation, One Student ID’ (https://apaar.education.gov.in)}

^{3 Digital Personal Data Protection Act, 2023, Section (s) 4 and 5.}

^{4 Digital Personal Data Protection Act, 2023, Section 7.}

^{5 Digital Personal Data Protection Act, 2023, Section 8.}

^{6 Digital Personal Data Protection Act, 2023, Section 9.}

^{7 Digital Personal Data Protection Act, 2023, Section 12.}

^{8 Digital Personal Data Protection Act, 2023, Section 11.}

^{9 Digital Personal Data Protection Act, 2023, Section 13.}

^{10 Justice KS Puttaswamy (Retd) v Union of India, MANU/SC/1044/2017.}

^{11 Constitution of India, 1950, Article 21.}

^{12 Digital Personal Data Protection Act 2023, Section 16.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.