DPDP Rules for Sports Academies: A Parental Consent Checklist

Think about the last child who joined your academy. You probably have their name, date of birth, school, a parent's phone number and maybe an Aadhaar copy. You may also hold a medical note about asthma, a photo in the batch WhatsApp group and a video of their first match on your Instagram page. Under India's new data protection law, every one of those is a child's personal data, and your academy is responsible for it.

The DPDP Act sports academy question is no longer a future problem. The Digital Personal Data Protection Rules were notified in November 2025, and most duties start in May 2027. That sounds far away, but the parents who sign up in January and April will still be with you when the law applies. If you collect consent the right way from now on, you will not have to chase 200 families for new forms later.

This guide explains what the law asks of a sports academy, where your real risks sit, and what a parental consent form should say. It ends with a one-page checklist. It is not legal advice, so speak to a lawyer about your own setup.

Why Every Academy Is a "Data Fiduciary" Under the DPDP Act

The Digital Personal Data Protection Act, 2023 uses two key terms. A data principal is the person the data is about. A data fiduciary is whoever decides why and how that data is used.

When you decide to collect a date of birth for age groups, or a phone number for fee reminders, you are the data fiduciary. It does not matter whether you run a 30-athlete swimming batch or a 500-athlete multi-sport academy. The software you use, the payment gateway and the cloud provider are only data processors. They act on your instructions, and the duty to the family stays with you.

Two more points make academies a special case:

• A "child" means anyone under 18. For most academies, that is nearly every athlete on the books.
• Children's data carries extra rules. You need verifiable consent from a parent or lawful guardian before you process it. You must also avoid tracking, behavioural monitoring and targeted advertising aimed at children.

The fines are large. The Act allows penalties of up to Rs 200 crore for breaking the duties around children's data, and up to Rs 250 crore for failing to take reasonable security steps. The Data Protection Board must weigh how serious the breach was and what the academy did to limit harm, so a small academy is unlikely to face the top figure. Still, "nobody will check" is not a plan, especially when one angry parent can file a complaint.

The Timeline: What Starts When

The Rules did not switch on all at once. They come into force in three stages.

1. November 2025. The Rules were notified, and the Data Protection Board was set up.
2. November 2026. Consent managers can register with the Board. These are approved platforms that let a person give, manage and withdraw consent in one place. You do not have to use one, but parents may start to.
3. May 2027. The main duties apply. These include clear notices, verifiable parental consent, security safeguards, breach reporting, erasure and the handling of complaints.

Many owners will wait until April 2027 and then panic. A better plan is to use the next six months to fix your forms and habits, while your enrolment numbers are still manageable.

What Data Your Academy Actually Holds

Most owners think of "data" as the admission form. In practice, a typical academy holds children's data in at least six places. Take a 120-athlete cricket and football academy in Pune as an example.

• Admission forms. Name, date of birth, school, address, parent contacts, and often a photo and a birth certificate or Aadhaar copy. Paper forms often sit in an unlocked cupboard for years.
• Medical notes. Asthma, allergies, past injuries and a doctor's fitness note. This is the most sensitive data you hold.
• WhatsApp groups. A batch group of 40 parents shows every member's phone number to everyone else, along with photos of the children.
• Coaches' phones. Match videos and photos taken on personal phones, which leave with the coach when they quit.
• Social media. Reels, tournament photos and "player of the month" posts with a child's full name and school.
• Spreadsheets and apps. Fee sheets on a shared Google Drive, fitness test results and, for some academies, data from wearables such as heart rate and sleep.

A quick exercise helps here. Write these six places on one page and, next to each, note who can see the data and how long you keep it. Most academies find that their biggest gaps are not in their software. They are in WhatsApp groups, coaches' phones and old paper files.

Ask one more question for each item: do you really need it? The Act says you should collect only what is needed for the purpose you state. You need a date of birth to place a child in an age group. You probably do not need a full Aadhaar copy for a weekend skating class. If you do need ID, ask for a masked Aadhaar, which hides the first eight digits. Collect less, and you have less to protect.

Verifiable Parental Consent in Practice

Consent under the Act must be free, specific, informed, unconditional and unambiguous. It must be a clear yes, not a pre-ticked box. For a child, it must come from a parent or lawful guardian, and you must take reasonable care to check that this person is really an adult parent.

How to check the parent

Rule 10 gives broad routes rather than one fixed method. You can rely on identity and age details you already hold for that parent, such as a parent account already verified in your system. Or you can use details the parent provides, including a virtual token from an authorised service such as DigiLocker. For most academies, the practical approach is simple:

• Meet the parent in person at the trial or admission, and record that you did.
• Collect the parent's name, relationship to the child and phone number on the form.
• Confirm the phone number with an OTP or a call before the child starts.
• For online sign-ups, send the consent link to the parent's number, not the child's.

What the consent form should say

The Rules ask for a notice that is clear, stands on its own and is easy to understand. It should not be buried in fee terms. A good one-page form for an academy covers:

1. What you collect. List each item: name, date of birth, contacts, medical notes, photos, fitness results.
2. Why you collect it. Link each item to a purpose. Medical notes are for safety during training. Fitness results are for progress reports.
3. Who sees it. Coaches, the office and named service providers such as your academy software and payment gateway.
4. How long you keep it. For example, until the child leaves, plus whatever period tax law needs for fee records.
5. How to withdraw or complain. Give a named contact person, an email address and the fact that the parent can complain to the Data Protection Board.
6. Separate tick boxes for optional items. Photos on social media, wearable data and sharing results with a state association should each have their own yes or no.

The last point is where most academies go wrong. If a parent must agree to Instagram photos to enrol their child, that consent is not "free". Keep training and fees in one part of the form, and every optional use in another.

How to record it

Recording consent matters as much as collecting it. If a parent complains, you need to show what they agreed to and when. For each child, keep the date of consent, the version of the form, who gave it and any later withdrawal. A signed paper form in a file can work. A digital record that you can search is far easier to manage once you pass 50 athletes.

Photos and Videos on Social Media: The Most Common Mistake

Every academy wants to post wins. A photo of a 10-year-old lifting a trophy is the best marketing you have. It is also the place where you are most exposed.

Here is a common pattern. A coach posts a reel from a district tournament. It shows the child's face, full name, school jersey and the academy's address in the caption. The parent never agreed to it. A relative shares it, and a stranger now knows where the child trains and studies.

Follow a few simple habits to avoid this:

• Get separate photo consent on the admission form, with a clear yes or no.
• Keep a "no photo" list that every coach can see before a match day.
• Use first names only in captions, and never name the school.
• Post group shots instead of close-ups where you can.
• Remove the post quickly if a parent withdraws consent. Agree a time, such as 48 hours, and keep to it.
• Do not run paid ads that target children, and do not use a child's photo in an ad without explicit written consent from the parent for that ad.

WhatsApp groups need the same care. Use the "announcements only" setting, remove families who have left, and avoid posting medical or fee details in a group chat.

Staff Access, Retention and Deletion Requests

Staff access

Not every coach needs every file. A football coach needs their batch list and maybe allergy notes. They do not need parents' income details or other batches' fee records. Give each role only what it needs, and remove access on the day a staff member leaves. Our guide to setting up staff roles and permissions walks through a simple structure.

Personal phones are the hard part. Ask coaches to share match photos to an academy account and then delete them from their own phones. Write this into the coach's contract, so it is clear from day one.

Retention

The Act expects you to erase personal data once the purpose is over, unless another law needs you to keep it. In practice:

• Keep fee and invoice records for as long as tax law needs.
• Delete medical notes and photos within a set period after a child leaves, such as six months.
• Shred old paper forms, rather than just throwing them out.
• Delete trial leads who never joined after a fixed time, such as one year.

Requests from parents

From May 2027, parents can ask to see a summary of the data you hold, correct it, or have it erased. They can also withdraw consent. You need a named person and an email address for these requests, and a simple log of when each one came in and how you handled it. For a small academy, this can be the owner and a shared inbox.

If something goes wrong

Lost phones, hacked email accounts and spreadsheets shared by mistake all count as breaches. The Rules ask you to inform affected families and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours. Write down now who would make those calls, so you are not working it out in a crisis.

A One-Page DPDP Checklist for Sports Academies

Work through this list over the next six months. Most items cost nothing but time.

1. Map where you hold children's data: forms, phones, WhatsApp, social media, sheets and apps.
2. Remove fields you do not need from your admission form.
3. Write a clear, one-page notice and consent form with separate tick boxes for photos and other optional uses.
4. Check the parent's identity at admission and confirm their phone number.
5. Record the date, form version and person for every consent, plus any withdrawal.
6. Keep a "no photo" list and a written social media policy for coaches.
7. Set WhatsApp groups to announcements only and clean them up every term.
8. Give staff role-based access and remove it on their last day.
9. Set retention periods and a yearly date to delete or shred old records.
10. Name a contact person for parent requests and keep a simple request log.
11. Write a short breach plan: who calls whom, and within what time.
12. Ask your lawyer or CA to review your forms before May 2027.

If you are still setting up your academy's legal structure, read our guide to registering a sports academy in India first.

Where Academy Software Helps, and Where It Does Not

Software cannot make you compliant on its own. It can make good habits easier, and it can take data off phones and paper. With Sportia , medical information and emergency contacts are stored encrypted, and staff roles limit who sees what. In the High Performance module, nothing about an athlete's health or wellness can be recorded until consent is given. For a minor, the parent accepts in their own login, or staff record consent given on paper. Sportia keeps the date and the notice version, and the parent can withdraw consent at any time from the My Health page.

You can also add a custom field, such as "Photo consent", to each athlete's profile, so coaches can check it before match day. Parents see their child's schedule and progress in a parent portal instead of a crowded WhatsApp group. Requests to see or erase data still need your own process, so keep that request log either way.

Frequently Asked Questions

Does the DPDP Act apply to small sports academies?

Yes. The Act applies to anyone who processes personal data in digital form, and there is no exemption for small academies that handle children's data. Paper forms that you later type into a sheet or app are covered too.

When do sports academies need to follow the DPDP Rules?

The Rules were notified in November 2025. Consent managers can register from November 2026, and most duties, including verifiable parental consent, apply from May 2027.

Who counts as a child under the DPDP Act?

Anyone under 18 counts as a child. For children, you need verifiable consent from a parent or lawful guardian before you process their personal data.

Do I need a parent's consent to post my students' photos on Instagram?

You should get separate, clear consent from the parent for social media use. It should be optional, not a condition of joining, and you should remove photos promptly if a parent withdraws consent.

Is a sports academy exempt as an educational institution?

The Rules give educational institutions a narrow exemption, mainly for tracking and monitoring done for education or child safety. It is not clear that every sports academy qualifies, and the exemption does not cover marketing or social media. Do not rely on it without legal advice.

What is the penalty for breaking the DPDP rules on children's data?

The Act allows a penalty of up to Rs 200 crore for breaking the duties on children's data. The Data Protection Board considers the seriousness of the breach and the steps taken to limit harm when it sets the amount.

Start With the Next Admission Form

You do not need a lawyer on retainer or a compliance team to get ready. Start with the next admission form you hand out. Separate the optional uses, check the parent and record what they agreed to. If you want consent, health data and parent updates in one place instead of phones and cupboards, try Sportia free for 14 days .