Who owns your student data on a coaching app?
Your institute should own its student data, with the vendor processing it only on your instructions, but only the contract and a working export make that true. Here's what to check.
On this page 7 sections
Your institute should own its student data and the vendor should only process it for you, but only the contract and a working export make that true. Under India's DPDP Act, your institute is then the Data Fiduciary and the vendor is a Data Processor acting for you. On a platform's own marketplace app, students may sign up as the platform's users instead. Read the contract, test the export before you sign, and agree in writing what happens when you leave.
This is general information, not legal advice. For your own contract, speak to a lawyer.
What counts as your data
"Student data" is more than a list of names and phone numbers. When you leave a platform, these are the things you will need, and the form in which they are actually useful:
| Data | Examples | A usable export |
|---|---|---|
| Student profiles | Name, phone, email, city, target exam, parent's contact | A spreadsheet with one row per student and a stable student ID |
| Enrolments | Batch, start and expiry dates, coupons, manual enrolments | Linked to the student ID and batch, with validity dates |
| Payments | Amounts, dates, gateway transaction IDs, invoices, refunds | Rows that match your payment gateway's own records |
| Learning records | Watch history, attendance, progress | Per student and per lecture, with dates |
| Test data | Attempts, answers, scores, ranks | Attempt-level detail, not just final totals |
| Question banks | Questions, options, solutions, diagrams, Hindi text | A Word or Excel format another system can import, with images intact |
| Content | Original lecture files, PDFs, live class recordings | The original files, not only the copies prepared for streaming |
| Conversations and leads | Doubts, chat history, enquiry forms | Dated, and linked to student IDs where relevant |
Lectures, notes and question banks are not personal data, but they are usually the most expensive things to recreate. Treat them in the contract exactly as you treat student records.
What Indian law says, in brief
The Digital Personal Data Protection Act, 2023 describes roles rather than ownership. Four points matter for a coaching app:
- You are responsible. The Data Fiduciary remains responsible for personal data processed on its behalf, including by a Data Processor (Section 8(1)).
- A contract is required. A Data Fiduciary may use a Data Processor only under a valid contract (Section 8(2)).
- Deletion reaches the vendor. When consent is withdrawn or the data is no longer needed, you must erase it. You must also make your processor erase it, unless a law requires you to keep it (Section 8(7)).
- Portability is a contract question. The Act gives students rights to a summary of their data, correction and erasure. It doesn't give your institute a right to receive data from a vendor in a particular format. That comes from your contract.
Most of these duties apply from May 2027 under the DPDP Rules, 2025, but contracts signed now will still be running then. Our DPDP Act compliance checklist for coaching institutes covers the wider duties, from notices to breach reporting.
Your own app vs a marketplace app
The set-up of the app changes who controls the student relationship.
In a branded app in your institute's name, students sign up under your privacy notice. The vendor runs the software as your processor, and in principle every record belongs to your account.
In a platform's own marketplace app, a student usually creates an account with the platform and accepts its terms and privacy policy. The platform may then act as a Data Fiduciary in its own right. It decides how it contacts the student, what it recommends and whether the account survives your departure. What you can take away is whatever its terms allow, which may be far less than the table above.
Before you choose, ask each provider three plain questions:
- Whose privacy policy does a student accept at sign-up: ours or yours?
- Can you contact our students about other courses or other educators?
- If we leave, do our students' accounts stay with you?
Contract clauses to check
Standard terms are written by the vendor. Read them, or ask your lawyer to, with this list beside you:
- Ownership. Data and content that you and your students provide remain yours. The vendor gets a licence only to provide the service.
- Purpose limit. The vendor uses student data only to run your service, not to market other products to your students or to share with other customers.
- Aggregated data. If the vendor may use anonymised or aggregated data, the contract says what that means and that it can't identify your institute or students.
- Sub-processors. A list of the cloud, video, SMS, WhatsApp and analytics providers that handle your data, and notice before it changes.
- Security and breaches. The safeguards the vendor maintains, and how quickly it tells you about a breach. You have your own reporting duties, so the vendor's notice must be fast enough for you to meet them.
- Export on demand. You can export at any time, ideally yourself from the admin panel, in standard formats, at no extra charge or at a price stated in advance.
- Exit assistance. A full export at termination within a stated number of days, including original video files, and a period of read-only access afterwards.
- Accounts in your name. Developer accounts, app listings, the domain, the payment gateway and push notification credentials are yours, or are transferred to you on exit.
- Deletion. After the export and an agreed period, the vendor deletes your data and confirms it in writing, except what the law requires it to keep.
- Disputes. Access and exports are not withheld during a billing dispute.
Test the export before you sign
A clause is only as good as the export behind it. During a trial, add a few test students, enrol them, record a payment and attempt a test. Then export everything and open the files.
- Check the columns. Look for phone numbers with country codes, enrolment and expiry dates, gateway transaction IDs and answers for each attempt.
- Check Hindi text. If names and questions turn into question marks or boxes, the export is using the wrong text encoding.
- Ask how videos come back. Streaming copies are cut into small encrypted pieces that are of no use elsewhere. You need your original files, or a full-quality copy of each.
- Ask about the question bank. Questions with diagrams and formulas should export in a format another system can import, not as a PDF.
- Ask about logins. A well-run platform stores passwords as one-way hashes, so they can't be exported in usable form. On a new system, students will set a new password or log in with an OTP. Our guide to password hashing explains why this is a good sign, not a problem.
What happens when you leave
Even with good terms, leaving goes better as a planned sequence:
- Give notice as the contract requires, and confirm the export timeline in writing.
- Take a full export early, and a final one at the cut-off date.
- Check the counts against your own records: students, active enrolments and payments in your gateway.
- Move content and students into the new system and rebuild batches with the right validity dates. Our guide to migrating courses, videos and student data covers the details.
- Tell students when and how to switch, and keep old access open until the cut-off.
- Update or transfer the app, so students receive an update rather than having to find a new app.
- Ask for written confirmation that the old vendor has deleted your data after the agreed period.
Payments are the easiest part if fees always went into your own gateway, because the payment history already sits in your account. See payment gateway charges in India for why that matters. For the switch itself, use our LMS migration checklist.
Upclass gives coaching institutes branded apps in their own name on Android, iOS, Windows and Mac, with courses, live classes, tests and online test series. Student fees go to the institute's own payment gateway. See the full platform on our LMS for coaching institutes page.
Frequently asked questions
Who owns student data on an LMS?
In a branded app run for your institute, the institute should own it. The vendor should process it only on your instructions, as a Data Processor under the DPDP Act. Whether that is true in practice depends on the contract and on whether the vendor can export everything. On a marketplace app, the platform may treat students as its own users.
Can an app vendor use my students' data for its own purposes?
Only if your contract allows it, so check. A vendor acting as your processor should use student data only to provide your service. Watch for clauses that let it contact your students, share data with other customers or use it for its own marketing. Also ask what any "aggregated data" clause covers.
Can I get my videos back if I leave a coaching app platform?
You should be able to, but confirm it before you sign. Ask whether the vendor keeps your original files or a full-quality copy, how long an export takes and what it costs. Copies prepared for streaming are split into encrypted pieces and are not useful on another platform.
What should a data export from an LMS include?
It should include student profiles with a stable ID, enrolments with validity dates and payments with gateway transaction IDs. It should also cover watch history, attendance, attempt-level test data, question banks in an importable format, and original lecture files and PDFs. Test a sample export during your trial, including Hindi text, before you rely on it.
