Education Sector Contracts in India: Faculty, Vendors, Parents and MoUs, and the Children's-Data Rule Coming in 2027
Schools, colleges and ed-tech companies sign faculty contracts, vendor agreements, student and parent consents and inter-institution MoUs. What the law requires in each, the children's-data point under the DPDP Act, and how to manage them with a small administrative team.
Educational institutions are document-heavy and administratively thin. A college signs faculty contracts every term, vendor agreements for transport, catering, IT and security, consents with students and parents, and MoUs with other institutions and industry partners. Each has a legal point that is easy to miss, and from May 2027 the DPDP Act's rule on children's data applies to most of what a school collects. This guide sets out the four document types and how a registrar's office can manage them. Position as of October 2026.
1. Faculty and staff contracts
Faculty may be permanent, fixed-term (visiting, adjunct, project-funded) or contractual. Under the Industrial Relations Code, 2020 (in force from 21 November 2025), fixed-term employment is defined in section 2(o) as engagement on a written contract for a fixed period, with entitlement to hours, wages, allowances and benefits not less than a permanent worker doing similar work, and expiry of the term is not retrenchment. Regulatory norms of the UGC, AICTE or the relevant state body set qualification, workload and service conditions for recognised institutions and should be cross-referred, not reproduced, in the contract. ****
Clauses: role and workload, term and renewal, notice, IP in course materials and research (assignment or licence to the institution, with academic-use carve-outs), confidentiality of student data, code of conduct, and no post-term non-compete (void under section 27 of the Indian Contract Act, 1872).
2. Vendor agreements
Transport, catering, hostel services, security, IT and learning platforms. Points that follow from Indian law:
- MSE vendors must be paid within 45 days of acceptance (section 15, MSMED Act, 2006); since Assessment Year 2024-25 a late payment defers the payer's deduction under section 43B(h) of the Income-tax Act, 1961 where the institution is a taxable entity.
- Learning platforms and IT vendors that process student data are Data Processors under section 8(2) of the DPDP Act, 2023; a processing contract with security provisions (rule 6, DPDP Rules, 2025) and a breach-notification window supporting the institution's 72-hour report (rule 7) are needed by 13 May 2027.
- Transport and catering carry safety obligations; insurance certificates and compliance undertakings should be dated obligations in a register.
3. Student and parent documents
Admission forms, fee agreements, hostel undertakings, consents for trips and activities, and data notices.
The children's-data rule. Section 9(1) of the DPDP Act requires a Data Fiduciary, before processing personal data of a child (under 18), to obtain "verifiable consent of the parent" or lawful guardian, as clarified by the Removal of Difficulties Order of 5 October 2026; section 9(2) prohibits processing likely to cause detrimental effect on a child's well-being; and rule 10 of the DPDP Rules prescribes how verifiable consent is obtained. Rule 12 provides exemptions for certain processing by educational institutions. **** These commence on 13 May 2027. Schools should redesign admission and consent flows now: a separate, verifiable parental consent for data processing, distinct from the fee agreement.
Execution. Parental consents and fee agreements can be e-signed; OTP eSign or a platform signature with a verified mobile number is proportionate for most, with the audit trail retained.
4. MoUs with institutions and industry
Exchange programmes, internships, research collaborations, placement partnerships. The recurring mistake is an MoU that is "non-binding" except for the clauses that matter: say expressly which clauses bind (confidentiality, IP, data, costs) and which are statements of intent. State the term, renewal and a named coordinator on each side. Where students' data moves to a partner, the partner is a separate Data Fiduciary or a Processor; say which.
Managing it with a small office
| Document | Owner | Register entries |
|---|---|---|
| Faculty contracts | HR / registrar | Term end, renewal decision date, probation review |
| Vendor agreements | Administration | Renewal, insurance expiry, MSE payment dates, DPA status |
| Student and parent consents | Admissions | Consent version, parental verification, retention period |
| MoUs | Dean / principal | Term, renewal, coordinator, binding clauses |
One template per type, e-signature for all four, stamping where the state schedule requires (service agreements and leases typically do), and a monthly report of expiries and missing consents.
Where Legatio fits. Legatio gives a registrar's office the four templates, bulk e-signature for faculty and parent documents, dispatch tracking, and a register of renewals, insurance and consent versions. The regulatory requirements apply to the institution regardless of platform.
Position stated as of October 2026. General information; institutions should confirm their regulator's current norms.