Applicable Laws upon EdTech Start-ups in India & Legal Compliances for EdTech Start-ups in India: Best Corporate Lawyer Advice in Delhi NCR

Customs Lawyer in Delhi NCR | Customs Lawyer in Delhi | Customs Lawyer in Noida | Customs Lawyer in Gurugram |Export Import Lawyer in Delhi NCR | Export Import Lawyer in Gurugram | Legal Advice for Importers in Delhi NCR | Importers in Delhi | Importers in Gurugram | Importers in Noida | Importers in Delhi NCR | Importers in India | Legal Remedies for Importers in Delhi | Legal Remedies for Importers in Gurugram | Legal Remedies for Importers in Noida | Legal Solutions for Importers in Delhi NCR | Legal Services for Importers in Delhi | Legal Advice for Importers in Gurugram | Customs Attorney in Delhi NCR | Customs Attorney in Delhi | Customs Attorney in Noida | Customs Attorney in Gurugram |

“India in the last three years has seen an exponential increase in the incorporation of edtech start-ups. Further, the demand for edtech start-ups has also risen manifold. Thus, there exists a cogent and compelling need for these edtech start-ups to be made aware about the laws applicable upon the edtech start-ups in India and the registration process for the registration of an edtech start-up in India. Over here we shall be discussing in detail the applicable laws upon the EdTech start-ups in India, the legal compliances for the EdTech start-ups in India and corporate legal solutions for EdTech start-ups in India. The entire write up is prepared to properly educate the Entrepreneurs and the Founders of the edtech start-ups in India and to enable them to follow the statutory and non-statutory compliances which are applicable upon the edtech start-ups in India. We are trying to pen down a complete legal guide for the edtech start-ups in India.

The EdTech sector has undergone through a lot of challenges i.e. both technical challenges for edtech start-ups as well as non-technical challenges which includes legal challenges for edtech start-ups in India. Further, although a lot of investments is received by many edtech start-ups and edtech corporations yet the entire sector requires infusion of more funds and acceptance from the general public.. Further, the regulatory mechanism should also involve itself including the education boards and ministries to promote edtech companies in India.”

EdTech is the study and ethical use of employing appropriate technological resources and procedures to facilitate student learning and enhance performance. Startups are young businesses created to create a particular good or service, bring it to market, and make it impossible for customers to resist and replace it. EdTech Startups are businesses where equipment and software are created to improve classroom experience and increase student learning results. Although EdTech is still in its infancy, it already offers promise to adapt a curriculum to a student’s level of proficiency by delivering and reinforcing new material at a speed the student can handle. The use of technology in the classroom is generally praised, but some individuals are concerned that it is impersonal and might lead to monitoring and data collection on both students and instructors. The Covid-19 pandemic compelled people to switch from conventional face-to-face learning to online or virtual learning. It was a time of transition and gave some Edtech companies a chance to thrive and combat the pandemic. The term “education technology,” or “edtech,” refers to the field of technology that is devoted to designing and implementing solutions to be used in the classrooms that will make learning more interactive and interesting.
EdTech “helps to increase student performance, develop their learning skills, and lighten the load on teachers. The Edtech industry is diversified, with established companies like Byju’s and new start-ups trying their luck in India. UpGrad, Vedantu, and Eruditus became billionaires in 2021, while Unacademy reached the targeted $1 billion valuation in 2020. One of the most valuable firms in the nation is Byju’s, the first edtech startup in India, with a valuation of almost $22 billion. In India over the past few years, numerous new edtech startups have sprung up, bringing the market size of the sector to about $2 billion.”

Process of Registration of EdTech Startup in India: Best EdTech Start-up Legal Solutions
A huge surge in new firms has been occurring since the nation’s prime minister, Narendra Modi, launched the Startup India programme. More people are starting their own startups because of government tax breaks, benefits, and assistance. Most businesses’ founders and owners are often young, which is remarkable and says volumes about India’s amazing pool of creative brains. Even if you have a well-managed competent staff, good investors, and a clear business plan, failing to properly register your start-up in India might cause it to fail in a single day without warning. Numerous start-ups in India frequently overlook or ignore the legal structuring procedure and quickly run into serious problems. Therefore, it is essential to be aware of all the legal documentation needed to launch a start-up.
1. Incorporate your business
The first step is to incorporate your business as a Limited Liability Partnership, a Partnership firm, or a Private Limited Company. It must comply with all criteria for registering a business, including getting a Permanent Account Number, a Certificate of Incorporation, and other essential compliance requirements. Adhering to all standard business registration requirements, such as filing an application and receiving a certificate of incorporation or partnership registration, is a must.

2. Register your EdTech Start-up with Start-up India
The company must register as a startup. The entire process is straightforward and may be finished online. It is necessary to go to the Start-up India website and fill out the online business information form. Along with other information like the Startup’s user type, name, stage, etc., enter the One Time Password (OTP) sent to the email address. The Start-up India profile is then created by entering this data. This information is then entered to establish the Start-up India profile. The Indian government recently altered the term where the company remains as a startup from 7 to 10 years to provide possibilities and tax breaks for the firms for a longer run. If the annual turnover doesn’t reach Rs 100 crore in the next ten years, the business is still considered a startup. Once the firm reaches the milestone, it no longer continues to qualify to be labelled a startup. Startups can apply for different acceleration, mentorship programmes, and other challenges after creating a profile on the website. They can also access the resources required, including the Learning and Development Program, government schemes, state policies for startups, and free services.

3. Get DPIIT Recognition for your EdTech Start-up in India
The “Department for Promotion of Industry and Internal Trade (DPIIT) Recognition” should have given the company its approval. With this designation, startups can benefit from simple firm winding up, fast access to funding, three years of consecutive tax exemptions, and tax exemption on assets that are more costly than their fair market worth. Other advantages include relaxation of public procurement rules and self-certification under labour and environmental laws, and self-certification. For the first three years, startups are exempt from paying income tax. However, to qualify for such incentives, startups must be approved by the Inter-Ministerial Board (IMB). Startups certified by DIPP and the Indian government are entitled to IPR benefits without needing an extra certificate from the IMB.

4. Recognition Application and Number
After the applicant has self-certified and the relevant authority has verified the required documentation, a certificate of recognition will be issued. All the uploaded papers must be legitimate. The applicant will be penalised 50% of the Startup’s paid-up capital or a minimum of 25,000 if an erroneous document is uploaded. Upon receipt of the recognition number, the applicant may submit applications through any government of India facilitator for registering trademarks, patents, and designs.
Startup registration in India has become very easy if we calculate it from start to finish. The government has greatly boosted the economy from company registration to incubation help, government financing, and tax advantages. By making the Indian environment more appealing for burgeoning entrepreneurs, the government is contributing to creating a bright future for Make in India and limiting the brain drain to other nations.

Obstacles before the EdTech sector in India: Best EdTech Start-up Lawyer Advice
1. “One-Size-Fits-All” Approach:
According to “Swanubhuti Jain”, COO of “JITO” “Incubation and Innovation Foundation (JIIF)”, each company must provide a solution that addresses and resolves the issues of all parties involved if it is to flourish. She stated, “those working in the mobility sector solve the problem of consumer (buyer – ease of service availability), service providers (car companies, taxi fleets, and drivers), government (social impact)”. As a result, everyone is benefiting from this circumstance. But regarding the education industry, each party engaged perceives the issues differently and in various ways, making it difficult for most ideas to have wide appeal. The majority of startups in the industry lack dynamism.
2. Instability with Change:
“Swanubhuti Jain” stated that the majority of solutions include significant change management and steep learning curves throughout the board. Change management cannot be successful unless it addresses any persistent problems. She also added that the industry appears People who resist change and are complacent don’t feel the pangs to the same extent as changemakers.
3. Scaling Challenges at the Local Level:
Education is a large industry with widely varying methods, demands, and dynamics from region to region, unlike other industries that are fixated. The industry is highly decentralized, with separate organizations and designated colleges controlling certain regions. Due to this, organizations must be far more agile if they want to maintain the relevance of their products or services, which makes scaling difficult. Omkar Kulkarni, the head of the “GMC Calibrator program”, the digital accelerator run by Gray Matters Capital, said “I think in the phase of incipience, ed-tech entrepreneurs tend to focus on hyper-growth in terms of user acquisition instead of identifying impediments to a great learning experience to keep users engaged and create high economic value, which is very hard in education.”
4. Lack of Persistence and Funding:
Education is very content-focused, and the relevancy of the information is evolving daily. Education is a horizontal industry, as opposed to other industries that operate vertically. Therefore, changes in all sectors influence it.
“To impact such vast target segment, funding and perseverance are vital and both are challenging in case of startups as quick results are often chased, and hence it becomes difficult to sustain success,” stated Swanubhuti Jain.
5. Compromise on Learning Results:
Understanding that education is a very result-oriented industry is essential. The transaction starts off with a very specific expectation, which is frequently performing better on the test or earning a higher rank. Customer discontent and future sales are both directly impacted by failing to provide it in the medium to long run. Everything else is secondary to it.
Kulkarni continues by saying that the majority of ed-tech businesses find it challenging to measure their influence on enhancing end-users learning outcomes. For scaling, collaboration is crucial. “I have seen very few startup founders aware of the work done by corporates or other startups in the education sector and rarely reach out to them for partnerships,” he stated.
6. Selecting the Appropriate Business and Revenue Model:
One of the most difficult and time-consuming jobs is finding an appropriate business/revenue model. In the words of “Sunitha Viswanathan”, a senior associate at “Unitus Ventures”, “finding a cost-efficient and effective distribution is tough and most startups in India are unable to crack this.”
7. Lack of compatibility with the current model:
According to Viswanathan of Unitus, one of the reasons for failure is that ed-tech solutions cannot be integrated into the system as it is now set up. Any solution that attempts to lower administrative expenses for teachers in the classroom or an after-school learning app will have extremely limited acceptance until it can effortlessly integrate into the daily routine of the teacher or student. As a result, the product doesn’t take off.
8. Inadequate User Engagement:
According to “GMC’s Kulkarni”, only a few ed-tech solutions can inspire a desire to study by leading customers through an interesting, experience with personalized learning. The majority of ed-tech businesses fail to maintain user relevance, which results in a lackluster product market. “In my experience, I have seen that most ed-tech entrepreneurs are trying to solve problems that end users think do not exist,” he stated.
9. India’s Existing Talent Gap:
Another issue that practically every other startup in every other field is experiencing is relevant to ed-tech startups. We are referring to the dearth of qualified individuals with the necessary skill sets for developing technology. Sajith Pai, director of Blume Ventures, argues that the talent gap in India affects critical strategic and leadership positions and is particularly acute in the early phases of startups because of their inability to offer competitive compensation. We anticipate at least one more unicorn from the Indian startup scene this year, with 2020 just around the horizon. Despite the market’s seeming volatility at the moment, the stakeholders are still monitoring the ed-tech industry and are prepared to invest in promising future chances.
According to “Pranjal Kumar”, CFO, and head of the education fund of the “Bertelsmann”, “In my view, the failure rate for ed-tech startups is comparable with any other sector. Given that education is a high-involvement category and a career-affecting service, tech adoption is usually lower compared to other services and products. Hence, ed-tech startups can take more time to scale up than in some of the other categories.”

Challenges faced by EdTech Start-up Founders in India
Pre-MVP Stage:
At this point, one would do market research and preliminary customer development initiatives. At this point, the problem is still being validated, and efforts are being made to better comprehend the area. Unfortunately, a lot of entrepreneurs skip this step entirely and go on to the next. Without necessarily having the necessary information and awareness of the area they wish to operate in, they start work without any preparedness.
Challenges facing Ed-Tech founders:
1. Access to data: It is challenging to obtain true, accurate, and comprehensive data on market size and other financial operations.
2. Obtaining research evidence: This difficulty may continue in the next stages, but it should be considered from the outset. To support their approach to learning and teaching, education startups demand proof from science and research. For that, the UCL education program is highly recommended.
MVP Stage:
This is the stage that follows the launch of an MVP and user validation. Typically, this is the stage at which you begin reaching out to potential investors. This is where you may view real-time insights from potential users and customers, giving you more confidence in the problem and its solution.
Challenges:
1. EdTech requires rapid prototyping and pivots: Rarely does a product achieve great success without at least one pivot. It is really difficult at this time to attempt multiple tactics and test several grounds.
2. Investment: It is quite challenging to raise funds for an EdTech company, and there aren’t many VCs who focus on EdTech investments. This is since it normally takes years for an EdTech firm to establish itself to generate adequate sales, let alone profits. Not many investors are patient enough to invest in a product and a vision rather than a firm with an immediate or near-term return. There is also a problem for all EdTech founders in terms of manifesting the impact of learning and education on their users and measuring the value of what their product delivers, particularly at that early stage.
Product Stage:
At this point, the firm has received funding or opted to bootstrap and has a live product with a large number of users/customers. This is the stage at which one may shift from focusing solely on creating a product to focusing on creating a viable business that will support that product.
Challenges:
1. At this level, acquiring consumers for your product is not difficult if your value proposition is obvious and the product is beneficial in some way. The true problem is maintaining healthy levels of retention and engagement while increasing your user base.
2. Monetization: As previously mentioned, monetizing in EdTech is always difficult, and even the market’s behemoths, such as Duolingo, are continuously experimenting and attempting to figure it out. Historically, EdTech entrepreneurs have failed in this area.
3. Learning is a tremendously complicated process that needs a thorough grasp of how the brain functions and how people learn efficiently. It is based on a combination of science, engineering, and philosophy, therefore meticulous research and growth-oriented teams are required.
4. Schools, institutions, and businesses often have an approval procedure that can be quite extensive depending on your product and compliance requirements, especially considering the difficulties of materializing the value your product gives at times due to point 3.

Legal Obligations for EdTech Start-up in India
Web-based learning is being advanced in India by the EdTech company, and this development is occurring quickly. New enterprises should understand every legislation and rule governing conducting business in India. The development of “Digital India” and “Skill India” has made it easier to launch an EdTech startup. If you want to create an educational business, you must follow a few guidelines, which are discussed below.
1. Registration as an entity
An entity is a thing with rights and losses of its own. Tax compliance and responsibility are closely tied to entity registration. Technology enterprises are characterised by their usage of intellectual property, making business registration essential. Private limited companies or limited liability partnerships are the ideal legal structures for an EdTech company. The directors and partners in these arrangements are exclusively liable for their shares. The government will only acknowledge a legal entity’s existence when registered as one.
2. Protection of Intellectual Property (IP)
Protecting intellectual property rights is essential since it forms the basis of the technology-driven enterprise (IPR). All types of start-ups benefit from this legal process in India by having a legal document clearly stating who owns all of their assets. This document’s main purpose is to protect you against competitors who could try to produce the same services and goods as your company. IPR, therefore, empowers you to protect your inventions and product designs. Additionally, the IPR method is available in all nations since it gives the firm’s investors access to the original product and credit.
3. Register for GST Compliance
Filling out your tax compliance is the next step. Under the new GST framework, an EdTech must register.
4. Creation of Websites
The only thing that counts for a digital company is its internet presence. Websites and internet domains are very important in establishing a positive reputation in the industry. It would be best if you acquired a unique domain name so that people can use to distinguish your company from other companies and helps to reach it online. Having a unique domain name establishes credibility for corporate operations in India.
5. Compliance with Information Technology (IT) Act, 2000
An EdTech Startup platform may be regarded as an intermediary within the meaning of the Information Technology Act, depending on the particulars of the business model. According to Indian law, an intermediary must adhere to the 2011 Information Technology (Intermediaries Guidelines) Rules’ requirements.
6. Registration of Intellectual Property
A tech company’s intellectual property is its most important component. By registering it, you may provide the owner with exclusive property rights. The foundation of an EdTech framework is intellectual property; the appropriate party must own the rights. Registering it may stop others from utilising your intellectual property without your consent. Your IPR entails patenting the cutting-edge technology your company is introducing to the marketplace and registering your company’s trademark, which contains its name, logo, tagline, and other identifying elements, granting copyrights to the unique educational content you produce for your educational programmes, protecting your trade secrets, including those of your customers, partners, and programmers, etc.
7. Registration of essential agreements
To secure your company, you must engage in several commercial agreements depending on the laws that apply to an EdTech firm. These agreements include nondisclosure and confidentiality agreements, which forbid anybody associated with the company from disclosing trade secrets, intellectual property agreements, service agreements, and website policies and agreements.
8. Get a payment gateway
The Payment and Settlement Systems Act of 2007 governs payment systems in India a means of payment you accept from your customers or subscribers. Payment gateways used by businesses include PayUMoney, PayPal, and others.
9. Get data protection
Data protection laws are covered by the “Information Technology Act of 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011”.

Regulatory Laws for EdTech Startups in India:
There is no comprehensive law governing Ed-Tech Companies in India. The following is mentioned regarding the fragmented rules and regulations:
1. Intellectual Property Laws
All ed-tech platforms contain intellectual property that either they invented themselves or bought from someone else, which must be safeguarded. All ed-tech platforms will handle the following intellectual property rights.
2. The Copyright Act, 1957
Each Ed-Tech company creates its instructional models to provide to its customers. The instructional models created by platforms are protected by the Copyright Act of 1957 since they will be regarded as “literary creations” and fall within its jurisdiction. In India, copyright is formed as soon as the work is produced as long as it is original; therefore, registration of the right is not required. However, copyright that has been registered acts as proof of ownership and is valid for 60 years following the author’s passing.
3. Trade Marks Act, 1999
Trademarks like the product name, logo, label, phrase, number, packaging, etc., are protected by this law. Any mark that is “graphically portrayed” and connected to the proprietor’s business may be registered under the Act as long as it does not violate any of the absolute or relative grounds for registration. A trademark’s legal proof is highly recommended since a registration act as prima facie evidence. The usage of websites and internet domains is a crucial component of e-business. Even though there is no such law or regulation, Indian courts have expanded the trademark protection offered by the Trademark Act and its Rules to cover domain names.
4. The Patent Act, 1970
The Patents Act of 1970 in India allows for the protection of any innovation. Contrary to many other countries, India does not allow the patenting of software, algorithms, or business methods. Until they are combined with hardware, and the invention fulfils the criteria of originality, non-obviousness, and the need for a claim of non-infringement, learning-based goods and processes are not patentable in India. Identifying which inventions are patentable and which are not is the key challenge. EdTech platforms should avoid publicising its distinctive feature since doing so might prevent it from obtaining a patent.
5. Consumer Protection Laws
There have been very few cases where Ed-Tech businesses have been sued under the Consumer Protection Act. The District Consumer Dispute Redressal Forum has received a deficiency of service case against Byju’s in 2019. The complaint expressed dissatisfaction with the company’s training methodology and repeatedly asked that the service be discontinued. On the other hand, the business paid little notice and routinely withdrew funds from the applicant’s account. The consumer forum determined that Byju’s had provided inadequate service and had harassed customers. The forum additionally stipulated that the applicant would have to pay back any deductions and hold the forum blameless from any related legal expenses.
6. Data Protection Laws
The Ed-Tech industry is expanding, putting a lot of pressure on companies to handle user data students with the utmost care and caution because there is a significant risk that their data might be stolen in cyberattacks. “The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 were issued by the Indian Government”. These businesses will have sensitive and personal data about customers, including passwords, financial information, medical records, and other details. Under the legislation mentioned above, the body corporate is required to get the user’s permission before collecting such sensitive and personal data. However, body corporates in India that gather this information electronically are subject to these restrictions. Therefore, wider data protection rules are urgently needed to include Ed-Tech Platforms based outside of India.
7. Education Specific Laws
The University Grants Commission (Online Courses or Programs) Regulations were adopted by the University Grants Commission (“UGC”) in 2018. According to web-based learning, only non-technical courses are permitted to be delivered online. There are no online programmes or courses available in the technical fields of engineering, law, medicine, dentistry, or pharmacy.

Legal Advice for Edtech Startups in India
The number of users on the platforms of Ed-tech businesses has rapidly increased during the last several years. Therefore, EdTech platforms need to be careful about the claims they make about the services they offer on the platform. Due to the Indian ethos, which several court decisions have maintained over the years, and the fact that it is seen as a non-profit activity in the nation, many people criticise Ed-Tech. Education technology may be labour- and technology-intensive simultaneously, and it frequently is. This economic activity must be conducted fairly, openly, and equitably.
Following the flurry of recommendations and warnings, the self-regulatory organisation India Ed-Tech Consortium, which was just established, has vowed to “adhere to the Code of Conduct and construct a two-tier Grievance Redressal Mechanism.” In summary, it can be argued that to maintain the industry’s long-term survival and the security of the users of such EdTech Platforms, strong consumer protection laws, and efficient IEC, and adequate data protection regulations are required.
The Edtech firms must abide by the Information Technology Act, 2000, its guidelines, and the current data protection legislation in India until the Personal Data Bill is adopted. The data privacy regulations of other countries will also apply to those companies if the Edtech platforms cater to students from other countries. As more students choose online learning, Edtech companies will need to start establishing policies and procedures to protect the safety and wellbeing of the users. These companies are also in charge of combating cybercrime, given the sizeable amount of time such students spend on the platform communicating with teachers and other students or accessing digital information, both live and pre-loaded. These platforms will be subject to an increasing number of legal obligations in the future and will need to take the appropriate actions and put in place the necessary procedures due to the change in acceptable methods of education dissemination in the post-covid landscape and the larger role now played by Edtech platforms. If not, Edtech businesses risk getting into legal difficulties.

Data Privacy and Protection
In our country, “data protection” and “privacy” are fiercely disputed issues. Despite being significant, it is neither preserved nor safeguarded by a separate legislative body. Data refers to all details and facts created as well as acquired during the provision “of the services,” like analysis, graphs, footages (audio and/or visual), images, curricular, pictorial representations, software programs, and printings, notations, and published or unpublished documents that could be used to forecast the opportunity of the organization or the person.
Data can be of 2 types:
a) “Personal data”
In order to track or monitor a person online, private data about him could be used. It is any data pertaining to a named or identifiable person. No third party should be aware about this. Health, biological, fiscal, and residence data are examples of personal data.

b) “Non personal data”
Non-personal data includes everything but personal information. An individual’s general knowledge is what enables businesses to create plans for financial success. Data which is gathered by the government when conducting publicly funded initiatives.

Privacy
Depending on the legal context, privacy has many meanings. It is possible to refer to it as a right of an individual regarding their private details. It is protection from unlawful invasion.
Data Privacy
A user has the right to limit how much information an organization or a website gathers about them. Data privacy refers to the management of a user’s data, such as historical, fiscal, and land info, i.e., personal information that may be used to track, inspect, and identify the user ID on a website or an online platform, from being accessed by anybody or any intermediaries. It controls how data is processed and prevents unauthorized online access to it.
A website or platform is merely using data in the proper way. Internet users have faith in the intermediary, knowing that the data a website collects is secure and private. Since trust is crucial in every interaction, it is essential that there is a trustworthy relationship between the intermediary and the internet user; otherwise, the person’s online identity and privacy will be exploited and exposed.
There is no set limit on the amount of information that a site or organization may gather in the current digital age that has been established by the Indian legislature. The list below includes a few different kinds of data privacy.
• Online privacy
A crucial aspect of online privacy is the privacy policy of a website, which specifies how data is collected and used.
• Residential information
It is important to protect the privacy of personal data about a person, including their address and the living cost while collecting data.
• Medical privacy
In order to maintain the confidentiality of the user’s medical information, the organization and the user should not disclose it to anyone other than the organization and the user. It is essential to maintain the confidentiality between a doctor and a patient or it would constitute a violation of medical privacy.
• Fiscal privacy
The acquisition of fiscal data by a site is known as financial privacy. If it is not saved and secured, hackers may access credentials fraudulently.

Aftermath of Data Breach
Data can ruin a life of an individual if it is revealed. Personal data also includes biological data and educational records. If not caught in time, hackers could use personal information to commit fraud or purchase illegal goods using the user’s credentials, making him responsible for the purchase. Some websites market and sell data that could lead to intrusive ads. A “person’s right to freedom of speech and expression, which is guaranteed as a basic right under Article 19(1)(a) of the Indian Constitution, is inhibited if they are being watched or tracked online.”

Data privacy is difficult for a person to acquire. In hindsight, it is possible to accomplish this goal by controlling how organizations acquire and store data. Control and confidentiality are generally seen negatively. In fact, not all organizations uphold secrecy. In large organizations, data security and confidentiality safeguards are crucial. Smaller businesses, however, fall short in terms of transparency and secrecy.
Since the last decade, there have been numerous data breaches and thefts involving the data of significant companies, including Facebook, Mobikwik, etc. Users’ personal information kept on the servers is being taken and marketed on the dark web.
India detected over 1.1 million cyber intrusions in 2020. Comparing to the about 400 thousand the year before, this was a huge rise. In terms of the amount of cybersecurity threats that year, India had ranked in the top five. Moreover, India’s placed 3rd in terms of internet user numbers.

Data Restriction
The process of restriction or localization entails adjusting the operation within its limits.
It is the practice of keeping data on any gadget accessible inside national boundaries. There would be no restrictions or authorizations need to retrieve the data if it were kept domestically. Mutual Legal Assistance Treaties should enable the country to access data stored in the foreign cloud. The majority of this data is now kept in a cloud that is located elsewhere. Data localization is a crucial component of national security because it prevents foreign spying by storing data on a server that can be accessed at any time and is located within the nation.

Data Protection
Data protection is the barrier that keeps a person’s information safe from unauthorised access by outsiders and malicious websites that steal data. Data protection helps to protect against harmful cyberattacks and unauthorized access to users’ personal information while ensuring the safety of the data.
Examples of data protection include the passwords for a person’s online bank accounts and the encryption offered by the website.

Is charging for data security really ethical?
Selling security protocols for money is unethical. Every user has the right to privacy, which must be protected, and it is the responsibility of an organization to offer them the same degree of security. Some corporate companies charge extra fees from customers in order to safeguard them from unauthorized and fraudulent activities.
Security breach: selling of information on dark web
In the biggest data breach by a private company of 8.2 terabytes — in our country, reportedly contained the private details of 3.5 million users of the payment app MobiKwik and are being listed for purchase on the dark web.

Data Privacy and Personal Data Protection bill, 2019:
The Sri Krishna Group was established by the court as a special committee to draught a bill on personal data. On July 27, 2018, a statement was delivered by the committee led by BN Krishna, a former Supreme Court jury. The government drafted the Personal Data Protection, 2019 bill, which was then promptly referred to the Joint Parliamentary Committee (JPC) and has not yet been put into effect since the committee found the structure to be imprecise and unsuitable for the rapidly changing technological environment. The proposed bill’s approval required five amendments beginning in 2019. Clause 35 of the PDP, 2019, grants the state protection and allows it to acquire any user’s information as well as monitor information about the citizens of the country. The government has complete authority to monitor individuals and their online data (if required). Given that it is now a question of national security, there should be a legal structure in place. The terms “data fiduciary” and “data processor” are put forth in the PDP Bill. According to the GDPR, a “data fiduciary” and a “data processor” are equal to the term’s “controller” as well as “processor.” By punishing organisations for collecting user data without their permission, the measure protects people. In regards to trade performed in India, the marketing of products and services to people in India, or the characterization of people, the PDP Bill would not only pertain to people in India but also to citizens abroad. The bill further includes rules for the storage of consumer data.

Current Status of the PDP bill:
Since 2019, the Joint Parliamentary Committee purposefully focusing on the report actively. The committee was discussing a number of articles and sections, most notably Clause 35 of the bill, which exempts the government from laws relating to public order as well as national interest. After two difficult years, on November 22, 2021, the committee decided sending the bill to the parliament for consideration during the following session. With a small amendment, the committee kept the exemption clause, and while, however, the government has the authority to exclude itself from the applicability, it must only do so in special cases. Additionally, to control content flow, the committee suggested that all social networking sites establish a headquarters in India. There are widespread claims that it lacks the necessary protections for an individual’s right to privacy. Additionally, the panel had concluded that there was no clause addressing data collecting by device manufacturers.

Infamous privacy breach cases:
1. Pegasus spyware
• It was founded by the Israeli NSO (N stands for Niv, S for Shalev, and O represents for Omri, the founders) organization and is well-known for its zero-click monitoring devices, which have led to numerous legal challenges. End-to-end encryption is used by apps like WhatsApp and Facebook to prevent tracking and tracing. Pegasus, a software created by the NSO group, breaks through the encryption wall simply by placing a call to their phone, and it can erase the call once it is over. It also enables users to view encrypted messages and calls. Any device can have Pegasus malware infiltrate through a loophole without the device owner being aware of it. Using a zero-click exploitation, it may collect whatever information from the machine after installation, the data is completely under the control of the user. Around 300 authenticated Indian mobile phone numbers got listed as possible Pegasus spyware targeted numbers, according to a report by an international media consortium. The NSO organization stated that the spyware was created specifically for military and government to acquire valuable concealed information; however, this factor by itself does not ensure the privacy of an individual.
• On September 13, the panel of the Supreme Court deferred a decision, requesting information about whether the Pegasus malware was being used to illegally surveil citizens by the Center. The requests for independent investigations are in response to accusations of alleged spying by government agencies using the malware Pegasus from the Israeli company NSO on prominent politicians and people. Given that it might be a concern of national security, a more thorough investigation should be conducted and action taken as quickly as possible.
• Apple files a lawsuit against the NSO organization and provides fresh information on the Pegasus attacks on some iPhone owners.

2. Joker Malware
• Joker Malware is a type of spyware designed to steal personal data including debit and credit card numbers. When a consumer downloads a malicious app from the Google Play store, the Joker malware secretly enters their smartphone. This software is deadly and has corrupted over 200 malicious apps. Google took action and removed the applications that were putting users’ data at risk of malware. The spyware reappeared on November 21, 2021, and this time it damaged 15 Play Store apps. According to reports, the Joker software robs money from users by forcibly enrolling them in undesired paid memberships. Without the user’s consenting, it stimulates the device with ads before stealing the victim’s SMS communications, particularly OTP (One Time Password) messages used to confirm the transaction.
• This time, the Play Store has been found to have two latest forms of the malware known as “Joker Dropper” and “Premium Dialer”. These have been detected hidden in certain trustworthy apps.
• In order to elude Google detection, the spyware, according to the statement, “adopted an old technique from the conventional PC threat landscape and used it in the mobile app world to avoid detection by Google.”
• Numerous applications with millions of downloads on the Google Play Store were found to contain the Joker malware.

3. Emotet Botnet
• When a user clicks on a link given by the hacker via email that appears to be authentic, Emotet, a kind of malware that is also referred to as the “king of malware,” infects the computer. It propagates through one device to the next, making it possible for it to join the network as a bot. A botnet is a collection of hacked computers that work together to target a single computer or server by providing it more orders than it can perform. Emotet’s infrastructure consisted of tens of hundreds of servers spread throughout the planet. Each of these has unique capabilities for controlling affected victims’ computers, spreading to new ones, assisting other illegal groups, and eventually strengthening the network’s defences against the shutdown actions. Employing phrases like health and COVID 19 precautionary measures in emails, the hacker uses the Emotet malware to click-bait the victim and gain accessibility to personal data. In January 2021, eight police agencies joined together to take down the malware-infected system that Emotet had been utilizing.
• The world’s deadliest harmful software, Emotet, is disabled by an international team.

Decoding the Indian EdTech Sector: The road ahead for EdTech Start-ups in India
A turning point in Indian education has been marked by the “National Educational Policy 2020” (Policy). This policy’s main objective is to integrate ICTs into educational institutions to offer fresh, creative ways to empower educators and students, which is congruent with using the underlying elements behind the educational technology (EdTech) growth in India. Appealing characteristics like high scalability, consistent cash flows, and high-growth company strategies set this sector apart. Various EdTech companies have actively mobilized resources despite the global economic downturn through acquisitions and investments from local and worldwide markets, demonstrating this. According to reports, 1.5 billion dollars were raised in the Indian EdTech industry in the first 9 months of 2020, an increase from USD 409 million in the corresponding period last year. Leading the charge were Byjus, Unacademy, Vedantu, and Interview Bit Academy, which solidified India’s position as the world’s 2nd biggest e-learning market after the United States.
On the positive backdrop, to maximise the sector’s intrinsic value as a whole, the administration overseeing the Indian education industry has a crucial responsibility to defend against challenges encountered by EdTech businesses. The first aspect is the maze of rules that seem to enclose India’s EdTech industry. As stated in India’s 2017 Consolidated FDI Policy, the EdTech business is more closely tied to “e-Commerce activities” even if 100 percent FDI is allowed via the automated route in the education sector (FDI Policy). E-commerce is defined in FDI policy paragraph 5.2.15.2.2 as “the buying and selling of products and services, including digital goods, using a digital and electronic network”. It is further classified into two types of e-commerce models: inventory-based models and marketplace-based models. Even if it is permitted via the automatic route for marketplace-based e-commerce enterprises, the Indian government has been hesitant to accept 100% FDI for an inventory-based e-commerce model in order to protect the operations of smaller companies.
The delivery of educational services by Ed-tech companies through their platforms is likely to be categorized as inventory-based e-commerce, which is prohibited under FDI regulations. The impact on the EdTech industry will undoubtedly be bad. A caveat-based policy that permits FDI for EdTech via the automated route, especially for inventory-based models, is critical because, in recent years, ed-tech online platform providers have increasingly taken on the responsibilities of content suppliers and curators. The industries that depend heavily on the domestic market for employment, including running corner shops and other small businesses, will be protected if this approach is properly implemented.
Additionally, it is believed that the new “Consumer Protection (E-Commerce) Rules, 2020” (E-Commerce Rules) are sufficiently inclusive to include any products and services supplied or acquired through an electronic or digital network. EdTech enterprises may be controlled by the E-Commerce Rules due to the components of profit-making and commercialization in exchange for consideration paid for such services. The E-Commerce Rules are meant to govern ordinary e-commerce enterprises, but due to the term’s broad definition, the EdTech sector may unintentionally fall within its purview. As a result, the main compliance requirements that EdTech firms may need to meet the E-Commerce Rules cover everything from basic information disclosures to new and onerous responsibilities for marketing, service providers, and warranties.
Another significant regulatory issue that the EdTech industry must address is a lack of transparency regarding data protection obligations and responsibilities. The Information Technology Act, 2000, as revised by the “Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011”, governs the usage of personal data at the moment. The definition of sensitive personal data is relatively narrow, and there are no specific guidelines for how to use the personal information of consumers, who in the case of the EdTech sector are children. To address this issue and offer data protection while addressing the responsibility of organisations that handle data, particularly data belonging to minors, the “Personal Data Protection Bill” (the “Bill”) was launched in 2019. It is past time for the law to keep up with technology and make sure that individual data privacy and protection are not left to the whims of private businesses given the growing volume of personal data sent and the current lack of adequate management. To remove legal barriers and establish a modern data policy in India, the Bill must become law as soon as possible in light of “Vedantu’s” recent data breach, which exposed personal information such as emails and IP addresses of children and their parents. As a result, investor confidence would rise and investments in the EdTech sector, which has lately witnessed enhanced internet access and greater adoption of digital payment methods, would continue to flow steadily. The policy will give the education sector a significant boost and present a significant opportunity for businesses, especially given the rising number of conventional institutions and universities that are welcoming the concept of online learning, along with other enabling factors like the country’s high-speed internet infrastructure and the population’s adoption of smart devices. As a direct result of the policy’s execution, Byjus acquired White HatJr, a business offering coding education with headquarters in Mumbai, in August 2020 for an estimated $300 million.
EdTech has the amazing ability to break down conventional educational barriers and provide every student the freedom to work individually while remaining a member of the community. While the transition to EdTech will call for additional considerations for cyber-behavior like bullying, content monitoring, ensuring student protection, screening of educators to protect them against cyberattacks or phishing schemes, and so on, the task of ushering in this new dawn would necessitate significant legal and policy reforms to allow the industry to expand in India.
Authored By: Adv. Anant Sharma, Lehar Saini, Vritti Jain & Raghavendran Keerthana

 

#mylawyersadvice #anantsharma #startup #corporatelaws #laws #legal #India #elearning #edutech #edtech #edtechstartup #edtechchat #elearningsolutions #elearningplatform #elearninggroups #corporations #founders #enterpreneurs