Student Consent for AI-Assisted Services

A deemed university showed us their 'DPDP-ready' enrolment form. Item 14: I consent to the use of artificial intelligence for academic and administrative excellence, including sharing with partners. The partners were unnamed. The excellence was unnamed. Withdrawal was 'contact the helpdesk'. The helpdesk was the agent. That form is not a consent architecture. It is a wish.

This guide is for campus DPOs, counsel, registrars and the compliance officers who will be asked to bless a student-facing agent. It sits next to our earlier piece on consent architecture for agent-driven services and applies that map to campuses. It is not legal advice. The Digital Personal Data Protection Act, 2023, and the 2025 Rules as commenced, are the texts. Phasing matters: Board provisions began on 13 November 2025; consent-manager provisions on 13 November 2026; most remaining operational duties on 13 May 2027. Until operational duties apply, the IT Act and 2011 SPDI Rules remain part of the live story. Do not let a vendor collapse those dates into 'we are DPDP compliant'.

A campus is not a consumer app. Some processing will sit on consent. Some will sit on a Section 7 legitimate use — a function under law, a benefit or service the State or the institution must deliver. The skill is to stop using consent as wallpaper for the second kind, and to stop using 'we are a university' as wallpaper for the first.

One service, one basis, written

Enrolment and the official result are not a chatbot. They are functions the university performs under its Act and ordinances. A notice still belongs on the file. A consent checkbox does not make the result more lawful, and withholding the checkbox cannot be a condition of sitting an exam if the real basis is the function.

A career-matching agent that writes to private companies is not that function. That is a separate purpose. Consent, specific, informed, withdrawable, is the honest story. Admission-time wallpaper is not.

A hostel ticket matcher sits closer to administration of a service the student already receives. You may still choose consent for the conversational surface even if the ticket store has another basis. Surfaces are optional. Stores may not be.

If you cannot pick a column, do not switch the agent on.

Service	Likely basis to test with counsel	Consent theatre to avoid
Official result, enrolment, statutory certificate	Function under law / ordinance; notice	A checkbox that pretends the degree is optional
Fee demand and receipt	The same, plus accounts duties	Consent to 'financial AI partners'
Hostel plumbing ticket	Administration of a service already taken; notice; tighter for minors	A 12-page privacy policy nobody can withdraw
Optional career agent sharing with named companies	Consent per drive or a tight placement registration	'Partners' and 'excellence'
Alumni nostalgia newsletter	Fresh consent	Student email kept forever as implied love of the crest
Proctoring / room scan	Ordinance + necessity analysis; weak as free consent	Clickwrap at the exam login as if it were a choice

Notice that a student can actually read

DPDP notices are not a 9,000-word PDF. For each agent: who the fiduciary is, what data, what the agent will do, whether a processor exists, whether anything leaves India, how to withdraw if consent is the basis, and how to complain. First-generation design applies: one screen, the building for grievances, no English-only if you claimed Hindi support.

Purpose limitation in words the helpdesk can repeat. 'Improve our services' is how you smuggle training. If the processor contract has a training ban, say that in the notice. Students should be able to use it against you and against us.

Identity of the agent: students must know they are talking to a machine and that a human door exists. That is honesty. It is also how you avoid a record that looks like a registrar promised a result rewrite.

Withdrawal, and the orphan log

If consent is the basis, withdrawal must stop the processing that sat on it. It will not erase the official result. Say that, or you will be asked to delete a degree. Logs you keep for CERT-In, audit and unfair-means may outlive the conversational history. Say that too.

Withdrawal must not be 'ask the agent nicely'. A URL or a desk that a human reads. The agent may take the request. The agent may not sit on it.

Joint services with an affiliated college need a joint sentence: which fiduciary you are writing to, and whether withdrawal at the college stops the university exam agent (usually no).

Minors and Section 9 — do not shrug

A child under the Act is a person under eighteen. Verifiable parental consent is required before processing their personal data, except where the government has prescribed otherwise. Section 9 also addresses processing detrimental to well-being and restricts tracking, behavioural monitoring and targeted advertising directed at children, again subject to the live Rules.

Secondary commentary disagrees on how far educational exemptions in the notified 2025 Rules actually run, and draft-rule numbers are not a substitute for the Gazette text on your desk. We will not invent a campus-wide exemption. Default: know the age from admission data, isolate children's tickets, do not run behavioural scores, and ask counsel to read the current Rules against each workflow.

A checkbox that says 'I am 18' is not verification. Age gates that only ask are how you collect a lie and call it a control.

Processors, and a notice students can actually use against you

Name the processor in the notice if there is one. 'Our technology partner' is wallpaper. If Prcept or any other firm is on the rack, say so, say on-prem or not, say the training ban, say how long chats live. A student who cannot name the processor cannot exercise a right.

Sub-processors are how a 'local' stack still phones a foreign safety filter. Write the egress. If the notice says nothing leaves India and the pcap shows a licence host, the notice is a false statement. Isolation drills belong in the DPO file, not only in the computer centre.

Grievance routing for agent-affected students should not be the same agent. Give a human desk and a clock. DPDP grievance duties, once operational provisions apply, will not be impressed by a loop. Until then, it is still decent administration.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Section 7 covers everything a university does.

It covers specified legitimate uses, not a tour of every optional agent you might invent. A mentorship-matching personality is not a subsidy. Map each service.

Consent managers will solve this in November 2026.

Consent-manager provisions have a commencement date. They do not write your purposes for you. Do the map now. Plug a manager later if you must.

We will put everything on legitimate use to avoid consent friction.

Then be ready to show the function under law. Optional marketing and optional sharing with companies will not fit. Overclaiming Section 7 is how you look worse than a sloppy checkbox.

Minors are rare on campus.

They are ordinary in diploma, integrated, and late-board cohorts. Rare is not a risk assessment. Age is a field.

A consent file for the next three agents

Do not boil the ocean. Write the three you will actually launch.

1. Week 1: list the three services. Pick a basis per row with counsel. Kill wallpaper clauses.
2. Week 2: write the one-screen notice and the withdrawal path. Separate official-record retention from chat history.
3. Week 3: age flag and Section 9 read of the live Rules. Turn off behavioural scores for anyone under 18.
4. Week 4: table the three rows at the AI cell. No launch without a row.

How this shows up in the file

DPO note: bases, notices, withdrawal URLs, processor training bans, age flags, and the sentence that a degree cannot be deleted through the chatbot. Attach the commencement dates so the file does not say you were 'fully DPDP' in 2026 if you were not.

If a vendor wants a single campus consent, they want a wallpaper. Refuse.

What the next file must contain

“Student Consent for AI-Assisted Services” earns a line in the noting only if a P6 Compliance/DPO can attach proof of “student consent AI DPDP.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “student consent AI DPDP.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.

This article is informational field guidance for Indian public universities and colleges, not legal, regulatory, academic, labour or procurement advice. Confirm against the live AICTE / UGC / NAAC notice, the DPDP Act and Rules as commenced, your Act and statutes, reservation orders, labour counsel and the syndicate before you file it.