The Complete Compliance Checklist for Schools and Edtech in India
A practical compliance checklist for Indian schools and edtech companies covering child safety, POSH, DPDP, labour laws and fire safety for 2026.
Schools and edtech companies share a compliance thread that most other sectors do not: both handle large volumes of data and safety obligations relating to children, on top of the standard labour and premises requirements every employer faces.
Key facts at a glance
- A POSH Internal Committee is mandatory for any school or edtech company with 10 or more employees.
- EPF applies once staff strength reaches 20 or more employees, with a Rs 15,000/month wage ceiling.
- ESI applies once staff strength reaches 10 or more employees, with a Rs 21,000/month wage ceiling.
- DPDP's substantive obligations - including additional consent requirements for processing children's data - become enforceable from 13 May 2027.
- Fire NOC and periodic fire safety certification are commonly required for school affiliation and renewal by most state boards.
- Penalties for DPDP breaches involving inadequate security safeguards can reach up to Rs 250 crore per instance.
Child safety and premises compliance for schools
Physical schools carry a distinct layer of obligations built around student safety. A Fire NOC is typically required before initial affiliation and at renewal, and many boards - state boards as well as CBSE and ICSE - make fire safety, building stability, and sanitation certificates a condition of continued affiliation, not just a one-time formality.
Background verification of staff who interact directly with children - teachers, bus drivers, support staff - is increasingly expected under state child-safety guidelines, even where it is not a single codified national requirement. Schools should also have a documented child protection policy covering reporting channels distinct from the employee-facing POSH mechanism, since POSH covers employee-to-employee harassment, not student safety incidents.
Labour compliance for school staff
Teaching and non-teaching staff are employees for the purposes of standard labour law, and schools should not assume any blanket exemption.
| Requirement | Threshold | Key detail |
|---|---|---|
| EPF | 20+ employees | Rs 15,000 wage ceiling; 12% + 12% contribution |
| ESI | 10+ employees | Rs 21,000 wage ceiling; 0.75% employee, 3.25% employer |
| POSH Internal Committee | 10+ employees | Covers all staff, including contract and support staff |
| Shops & Establishments | Applies from day one | Working hours, leave, and registration display |
Many schools also engage contract staff for transport, catering, and housekeeping through third-party vendors, which brings contract labour obligations - such as verifying the contractor's own PF/ESI compliance - onto the school as the principal employer.
POSH in the education sector
Schools sometimes assume POSH is only relevant to corporate workplaces, but the Act applies squarely to any employer, including schools, once the 10-employee threshold is crossed. The Internal Committee handles complaints between employees; a separate, clearly communicated channel is needed for anything involving students, since that falls outside POSH's scope and typically under child protection law and, where applicable, POCSO-related reporting obligations.
DPDP: the edtech-specific pressure point
Edtech platforms - whether standalone apps, school management systems, or online tutoring services - collect names, ages, academic performance, attendance, sometimes biometric attendance data, and parental contact details. Under the DPDP Act, 2023, this is personal data, and data relating to individuals under 18 is treated with additional care, generally requiring verifiable parental or guardian consent before processing.
While full substantive DPDP obligations become enforceable from 13 May 2027, edtech companies building or scaling now should treat consent capture, data minimisation, and retention limits as design requirements rather than a later retrofit - rebuilding consent flows across an existing user base is far more expensive than building them in from the start.
Business registration and tax basics for edtech
An edtech company is a standard commercial entity for company law, GST, and income tax purposes - there is no special regulatory carve-out simply because the product serves students. GST registration applies once turnover crosses the applicable threshold, and online educational content or coaching services may attract GST depending on the exact nature of the service (a distinction that has been the subject of ongoing clarification, so it is worth checking current treatment before pricing).
Bringing it together
A school's compliance load leans toward premises and child safety (fire NOC, background checks, affiliation renewals) layered on top of standard labour compliance. An edtech company's load leans toward data protection and standard commercial/labour compliance, with less premises exposure if it operates largely online. Both share the same POSH and PF/ESI thresholds once headcount grows.
If you are not sure where your school or edtech business stands on statutory compliance, ComplianceCheck's assessment gives you a clear picture in a few minutes.
Sources
- Ministry of Education - education.gov.in
- Ministry of Electronics and Information Technology (DPDP Rules) - meity.gov.in
- Employees' Provident Fund Organisation (EPFO) - epfindia.gov.in
- Employees' State Insurance Corporation (ESIC) - esic.gov.in
- Respective state education department and fire department
- Respective school board (CBSE, ICSE, or state board) affiliation guidelines
This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.
Frequently Asked Questions
- Does POSH apply to schools?
- Yes, the POSH Act applies to schools as employers of teaching and non-teaching staff, and an Internal Committee is mandatory once a school has 10 or more employees - separately, complaints involving students are typically handled through child protection and POCSO-related mechanisms.
- Do edtech companies collecting student data need to comply with DPDP?
- Yes, edtech platforms that collect student names, contact details, academic records, or usage data are processing personal data under the DPDP Act 2023, and data relating to children under 18 attracts additional consent and processing restrictions.
- Is a fire NOC required for schools?
- Yes, most states require schools to obtain a Fire NOC before affiliation or renewal, given the presence of large numbers of children on campus - many education boards also make fire safety certification a condition of affiliation.
- Do schools need to register teaching staff under PF and ESI?
- Schools with 20 or more employees generally need to register for EPF, and those with 10 or more employees generally need ESI for eligible staff, on the same wage ceilings that apply to any other employer.
- What background checks are expected for school staff?
- While requirements vary by state and school board, many affiliation frameworks and child-safety guidelines expect police verification or background checks for teaching and non-teaching staff who interact directly with children.
- Does an edtech company need a Shops and Establishments registration?
- Yes, an edtech company operating as a commercial entity - whether purely online or with physical offices - typically needs to register under the applicable state Shops and Establishments Act, like any other business with employees.
Check your status
Statutory Health Check
A 12-question health check of PF, ESI, Professional Tax, Gratuity and Bonus compliance for Indian employers.