Supreme Court Directs CBSE to Amend APAAR Consent Form with Opt-Out Option and Data Sharing Restrictions

In a significant ruling reinforcing data privacy protections for students, the Supreme Court of India in Abhishek Baxi v. Union of India (2026 LiveLaw SC 719) directed the Centre and the Central Board of Secondary Education (CBSE) to amend the consent form under the Automated Permanent Academic Account Registry (APAAR) scheme. The Court mandated the inclusion of an explicit opt-out option for parents and guardians, while also barring unauthorised third-party sharing of student data collected under the scheme.

Background of the APAAR Scheme

APAAR, or the Automated Permanent Academic Account Registry, is a national digital initiative designed to assign a unique academic identity to every student in India. Linked to Aadhaar, APAAR aims to create a comprehensive digital record of a student's academic journey, from school to higher education. The scheme envisages a centralised repository of academic credentials accessible to educational institutions and government bodies.

While the stated objective of APAAR is to streamline academic record-keeping and facilitate seamless credit transfers between institutions, concerns have been raised about the extent of personal data collected under the scheme and the adequacy of safeguards against misuse. Critics have pointed to the absence of a meaningful consent mechanism, arguing that the existing consent form did not provide parents with a genuine option to refuse participation.

The Petitioner's Challenge

The writ petition was filed by Abhishek Baxi and other parents of four students, challenging the constitutional validity of the APAAR scheme. The petitioners argued that the scheme, by compelling students to obtain Aadhaar-linked academic identifiers, violated the fundamental rights guaranteed under Articles 14 (equality before law), 19 (freedom of speech and expression), 21 (right to life and personal liberty), and 21A (right to education) of the Constitution.

A central contention was that the APAAR consent form, as it existed, did not offer a genuine choice. Parents were presented with a form that effectively treated consent as a formality rather than a substantive right, with no clear mechanism to opt out or refuse enrolment. The petitioners also raised concerns about the data-processing architecture underlying the scheme, arguing that it lacked adequate legislative backing.

Supreme Court's Key Directions

A Bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohan issued several important directions. First, the Court directed the Union Government and CBSE to amend the model consent form to explicitly provide parents and guardians with an option to refuse or withhold consent for generating an APAAR ID for their children. This direction ensures that consent under the scheme is truly voluntary and informed.

Second, the Court clarified that students who choose not to enrol under APAAR must not suffer any adverse consequences. This includes protection from denial of admissions, examination registration, mark sheets, certificates, or recognition of educational institutions on account of non-enrolment. The Court has similarly upheld the right of children to access education without bureaucratic barriers in other recent cases.

Data Sharing Restrictions

The Bench imposed clear restrictions on the sharing of student data collected under APAAR. It held that personal information gathered under the scheme cannot be disclosed, shared, or made available to any private entity or third party except in accordance with law and only for purposes authorised under the scheme. Any sharing of such data beyond the scheme's defined scope or for extraneous purposes was declared impermissible.

These directions align with the broader framework of the Digital Personal Data Protection Act, 2023, which imposes obligations on data fiduciaries to process personal data only for lawful purposes and with the informed consent of the data principal. For a detailed guide on complying with data protection requirements, see our article on how to comply with DPDPA Rules before the November 2026 Phase 2 deadline.

Reliance on Odisha High Court Precedent

The Supreme Court's directions built upon an earlier ruling by the Odisha High Court in Rohit Anand Das v. State of Odisha (2025), which had similarly directed authorities to make APAAR consent genuinely voluntary within the state. The Supreme Court extended this mandate across the country, directing CBSE to implement the Odisha High Court's order on a pan-India basis.

This approach of adopting and universalising a High Court's protective order demonstrates the Supreme Court's willingness to use state-level precedents as models for national reform, particularly in matters concerning fundamental rights. The Court has similarly taken an active role in safeguarding digital privacy in other contexts, including its directions restraining unauthorised circulation of live-streamed court hearings on social media.

Implications for Students and Parents

The ruling has far-reaching implications for millions of students and parents across India. Parents now have a legally affirmed right to refuse APAAR enrolment for their children without fear of academic repercussions. This is particularly significant for families concerned about data privacy or those who, for personal or religious reasons, may object to Aadhaar linkage.

The judgment also places a corresponding obligation on schools and educational institutions to respect parental choice. Institutions cannot make APAAR enrolment a prerequisite for admission or academic services. Any attempt to coerce or penalise students for non-participation would run contrary to the Supreme Court's directions.

For individuals concerned about the broader implications of data collected by government bodies, including judicial records, our guide on requesting de-indexing of court records from Google provides relevant information on managing personal data in the digital ecosystem.

Key Takeaways

1. The Supreme Court has directed CBSE and the Centre to amend the APAAR consent form to include an explicit opt-out option for parents and guardians.

2. Students who do not enrol under APAAR cannot be denied admissions, mark sheets, certificates, or any academic services.

3. Student data collected under APAAR cannot be shared with private entities or third parties except for purposes authorised under the scheme and in accordance with law.

4. The ruling extends the Odisha High Court's protective order in Rohit Anand Das v. State of Odisha (2025) to the entire country.

5. The judgment reinforces the constitutional right to privacy in the context of educational data and aligns with the objectives of the Digital Personal Data Protection Act, 2023.