Consent the regulator can audit. the regulator can audit
Every parent and student in the school has a consent record per channel and per purpose — transactional, promotional and OTP login codes — captured digitally at admission, append-only ever after. STOP replies on WhatsApp or SMS auto-unsubscribe within seconds, every email carries a one-click unsubscribe, and OTP login codes always go through regardless of unsubscribe state because regulators expect them to reach. Stored in Mumbai, audit-ready for DPDP Act 2023.
How most Indian schools handle parent consent today
In most schools the consent question has never been asked at all. The parent's phone number is collected on the admission form in March, written into a registry, and used for every kind of message the school ever sends — a fee receipt at 11 a.m., a daily absence alert at 9:14 a.m., a marksheet notification after results, a Diwali greeting in October, an alumni-fundraising appeal in February, a coaching-class advertisement from the school's tie-up partner. Nobody asked the parent which of these she wanted. Nobody recorded that she opted in. When she eventually replies STOP to the WhatsApp number in irritation, the office assistant has nowhere to record it and the August fee reminder gets sent anyway.
The cost is small at first and then very large. Parents complain, then escalate, then mute the school's WhatsApp number, then stop trusting the school's communication entirely. Meta downgrades the school's WhatsApp Business account quality score after a few parent-reported spam complaints, and the school's transactional fee receipts start landing in the spam folder. TRAI's DLT framework punishes the school's SMS sender ID with reduced delivery throughput. The Digital Personal Data Protection Act 2023 — enforceable for fiduciaries since the rules were notified — makes parental consent a legal obligation, not a courtesy, and the Data Protection Board can impose penalties up to ₹250 crore on a school that cannot produce a defensible consent record when asked. By the time the school realises, the damage to reputation and the regulatory exposure are both already done.
The deepest cost is operational, not legal. A school without a consent record cannot distinguish "this parent never wanted promotional messages" from "this parent never received a transactional fee receipt". The office assistant treats both as the same kind of failure and starts to send less, to be safe. Parents who actually want the alerts stop receiving them. Parents who do not want the marketing keep receiving it. The school's communication degrades into noise. Inkwelly's DPDP Act 2023 Consent Record is the screen that fixes this entire pattern — every parent has a per-channel, per-purpose consent record, captured digitally at admission, append-only ever after, with STOP-reply auto-unsubscribe and a one-click unsubscribe in every email. Transactional and OTP messages keep flowing where they should; promotional sends only go to parents who have actively agreed. The school becomes legal-grade compliant and operationally cleaner at the same time.
How the consent record actually works
When a student is admitted, the parent fills the admission form on the Student Information module — either on a smartphone, on the parent app, or on the office's computer with the office assistant assisting. The form has a small but clear consent panel at the bottom: three checkboxes for what the school will send and how — transactional messages (fee receipts, attendance alerts, marksheet notifications), promotional messages (school events, alumni invites, scholarship announcements), and OTP login codes. Each checkbox is per channel: WhatsApp, SMS, Email and Push. The parent ticks what she agrees to, signs digitally (a typed name plus a one-time SMS verification), and the consent record is created the same second.
From that moment forward, every message Inkwelly sends to that parent's number, address or device goes through a consent check. A fee receipt on a Saturday afternoon checks the transactional consent for WhatsApp; the message goes through. An alumni-event promotional broadcast on a Thursday afternoon checks the promotional consent for WhatsApp; if the parent did not tick that box, the message is dropped silently and the audit log shows "parent has not opted in to promotional WhatsApp" as the reason. An OTP login code at 11:43 p.m. bypasses every check because the parent expects the code to reach and the regulator requires it.
When the parent changes her mind — "please stop the alumni messages, they come every week" — there are three paths. She can open the parent app, tap Preferences, and untick promotional WhatsApp. She can reply STOP, UNSUBSCRIBE or BAND KARO to the next school WhatsApp; the keyword is auto-detected and the consent record is updated within seconds. Or she can click Unsubscribe on any school email, which leads to a one-page form where she can revoke promotional consent without contacting the office. Every change is appended to the record as a new row — the older state is never overwritten, so there is always a full history of who agreed to what, when, and how the change was captured.
What's covered in the consent record
- Three purposes per parent — transactional, promotional and OTP login codes — each described in plain English on the consent form, not as enum codes
- Four channels per purpose — WhatsApp, SMS, Email and Push — so a parent can agree to fee receipts on WhatsApp but not on SMS
- Captured digitally at admission — a clear three-checkbox consent panel on the admission form, with the parent's typed name and SMS verification
- Append-only audit trail — every change of mind creates a new row, no older row is ever overwritten or silently changed
- STOP keyword auto-detection — STOP, UNSUBSCRIBE, BAND KARO and similar opt-out keywords on WhatsApp and SMS update the record within seconds
- One-click unsubscribe in every email — the parent does not need to email the office or wait for a reply
- Self-service in the parent app — Preferences screen lets the parent change consent any time, on any channel, for any purpose
- OTP login codes always bypass consent — regulators require them to reach, so they go through unsubscribe state and quiet hours both
- Transactional messages continue when promotional consent is revoked — the parent keeps receiving fee receipts and attendance alerts she has not asked to stop
- Per-school evidence file — every consent grant or revocation has a timestamp, the source of the change (admission form, STOP reply, email click, parent app), and the digital signature
- Mumbai data residency — the entire consent record is stored on servers in India, compliant with DPDP Act 2023 data localisation
- Year-end audit export — the school can export the consent record for the Data Protection Board or any internal audit, in one CSV
See the consent record in action
Per-channel, per-purpose — the regulator's expectation
The Digital Personal Data Protection Act 2023 requires consent to be specific. A blanket "yes you may communicate with me" is not enough; the parent must know what she is agreeing to, on which channel, for which purpose. Inkwelly's consent record is built exactly to this standard. Each parent has three purposes, four channels each — twelve consent states in total, captured separately. The parent can agree to transactional WhatsApp but decline transactional SMS, agree to promotional Email but decline promotional WhatsApp, and OTP login codes always go through on every channel because the regulator expects them to reach.
This level of granularity is the difference between operating defensibly and operating in good faith. A school that records "parent agreed to messages" in a single row will not survive a Data Protection Board inquiry. A school that records "parent agreed to transactional fee-receipt WhatsApp on 14 March 2026 at 11:47 a.m. via admission form" has produced legal-grade evidence. Inkwelly produces the second kind of record by default — the school does not need to do extra work to get there.
Append-only — every change of mind becomes a new row
The single most damaging mistake a school can make in a consent record is to overwrite an older state with a newer one. The DPDP Act 2023 expects the school to prove that the parent's wishes were honoured at the time the message was sent — not at the time the inquiry happened. If the school overwrites "granted on 14 March" with "revoked on 14 August", it cannot prove that the August reminder was sent before the revocation was recorded.
Inkwelly's consent record is append-only. Every change — a STOP reply, a parent-app preference change, an email unsubscribe, a re-grant after a conversation with the office — inserts a new row with a fresh timestamp. The previous state is never modified. When the Data Protection Board asks "was the parent unsubscribed at the time of the August reminder?", the school produces the consent history with the August reminder's timestamp clearly between two consent rows, and the answer is unambiguous. No staff member, not even the super-admin, can delete a consent row — the only operation allowed on the record is append.
STOP-reply auto-unsubscribe within seconds
The parent's most natural way to opt out of school WhatsApp messages is to reply STOP to the last message she received. Most school SMS panels and broadcast lists do nothing with that reply — the office assistant has to spot it manually and update an Excel spreadsheet that no one looks at again. Inkwelly handles it automatically. STOP, UNSUBSCRIBE, BAND KARO and similar standard opt-out keywords are detected the moment the inbound reply arrives, the parent's consent record is updated within seconds, and the next promotional broadcast no longer includes her.
The parent's two-way inbox thread still shows the STOP reply so the office knows it happened, but the consent update is not waiting for human action. Transactional messages — fee receipts, attendance alerts, OTP codes — keep flowing because the parent has not unsubscribed from those (STOP only revokes promotional consent by default). A second-level keyword — STOPALL — unsubscribes from every promotional purpose on every channel. Both keyword behaviours are documented on the parent app, on the email footer, and on the admission form so the parent knows in advance what each opt-out keyword will do.
Self-service in the parent app
Asking the parent to call the office to change her consent is not self-service. The Inkwelly parent app's Preferences screen is. The parent opens the app, taps Preferences, and sees the same twelve-state matrix as her admission consent panel — three purposes, four channels. She toggles promotional WhatsApp off, taps Save, and the consent record is updated within seconds. The next promotional broadcast skips her automatically. She did not need to call the office, write an email, or wait for a reply.
This matters because the DPDP Act 2023 says consent must be capable of being withdrawn as easily as it was given. A consent record that takes three days and an office call to update fails this test. Inkwelly's parent app gives the parent the same kind of control over consent as she would expect from her banking app — instant, audited, reversible. The same screen also shows her a plain-English explanation of what each setting means, so she understands the consequence of each toggle before she taps it.
“DPDP Act ke baad humein parent consent record dikhana zaroori tha. Pehle hum nahi de sakte the — ab Inkwelly mein har parent ka consent, channel ke hisaab se, append-only, timestamp ke saath. Auditor ne dekha aur khud bola compliance theek hai.”
Real-world use cases — when the consent record protects the school
1. Parent complains to the Data Protection Board. A parent files a complaint that she received unsolicited alumni-fundraising messages from the school. The Board asks the school to produce the consent record. The school exports the parent's consent history, which clearly shows promotional WhatsApp was granted at admission in March 2024, was never revoked, and the fundraising message in question was sent after the consent was active. The matter is closed in the school's favour within two weeks.
2. Parent replies STOP, then complains anyway. A parent replies STOP to a promotional broadcast, then a week later complains that she stopped receiving fee receipts too. The school shows that the STOP keyword revoked only promotional consent (by design), that transactional consent stayed active throughout, and that the fee receipts were in fact sent and delivered (the message log timestamps confirm). The parent had archived the school's chat; the school's record is intact.
3. CBSE renewal audit asks for DPDP compliance evidence. The renewal committee asks the school to demonstrate it is compliant with the Digital Personal Data Protection Act 2023. The school exports the consent record for the academic year, showing every grant, every revocation, every STOP reply with timestamps and sources. The renewal goes through with no DPDP-related follow-ups.
4. Parent revokes promotional consent on the parent app, then changes mind a month later. The parent toggles promotional WhatsApp off in the app, the next two alumni-event invites correctly skip her. A month later, she enrols her daughter in the school's summer camp and wants the related promotional updates after all. She toggles promotional WhatsApp back on, the next summer-camp broadcast includes her, and the consent history shows both transitions with timestamps. No office intervention required.
5. A staff member tries to delete an embarrassing consent revocation. A class teacher who broadcast a promotional message to a parent who had unsubscribed wants to quietly clean up the audit trail. She cannot. The consent record is append-only — even the super-admin cannot delete a row. The teacher's only option is to discuss the matter openly with the principal, which is exactly what the DPDP Act 2023 expects schools to do.
Common operations the office and parent both run
- Capture consent at admission — three purposes, four channels, digital signature, one screen
- Re-prompt parents whose consent state predates the DPDP Act 2023 — one-click re-capture flow
- View a single parent's consent history with timestamps and sources
- Update a parent's consent on the parent app — Preferences screen, instant effect
- Detect and act on STOP, UNSUBSCRIBE, BAND KARO replies automatically
- Handle email one-click unsubscribe — link in every email footer
- Bypass consent for OTP login codes — they always go through, by regulator requirement
- Block promotional sends to parents who have not opted in — before the message is queued
- Show the pre-flight breakdown on every broadcast — 247 will get this, 8 have not opted in
- Export the consent record for a date range — quarterly DPDP review or board pack
- Surface STOP-reply trends — a spike in opt-outs from a section is a warning to investigate
- Re-grant after a revoke — the parent can opt back in any time, and the new row is appended
See the consent record on a real school dataset
Twenty minutes. A real school's consent record with admission, STOP replies and parent app changes. Bring your hardest compliance scenario — we will show how Inkwelly handles it end to end. No sales pitch.
Limits, safety and small print
The consent record covers every parent and student in the school whose contact details flow through Inkwelly. For parents already in the school before Inkwelly was adopted, the system uses a transitional rule — transactional messages and OTP login codes are allowed to flow on the assumption that consent is implicit (because the parent has been receiving these all along), but promotional messages are blocked until the school re-captures explicit consent through a guided one-click flow on the parent app. The transitional rule is documented in the school's onboarding pack and is the path most existing parents take.
OTP login codes always bypass consent and quiet hours — this is not a gap; it is a regulator-defined requirement. Both TRAI's DLT framework for SMS and Meta's WhatsApp Business policy treat OTP delivery as critical, and the parent cannot legally opt out of receiving an OTP for an account she has chosen to log in to. The Inkwelly consent record marks OTP as a separate purpose precisely so the parent (and the school's auditor) can see that this exception is deliberate, audited and well within the regulator's expectations.
The append-only rule is enforced at the database layer — no school staff member, not even the super-admin, can delete a consent row through the application. The only operation permitted is insert. If the school's account is closed or migrated, the consent record is preserved per Inkwelly's data-retention policy and can be exported as part of the closing handover. All consent data — grants, revocations, evidence files, digital signatures — is stored on servers in Mumbai. There is no analytics export of consent state to any third party; the consent record is the school's own legal evidence and stays inside the school's workspace.
DPDP Act 2023 compliance is not a one-time setup; it is an ongoing operational posture. Inkwelly handles the technical part — consent capture, audit trail, STOP handling, data localisation, append-only storage. The school still owns the policy decisions — which purposes to ask consent for, what the promotional window should be, how to phrase the admission consent panel for the school's specific board (CBSE, ICSE, IB, state boards each have small differences). Inkwelly's onboarding team walks through these decisions with the school during the first week, and the resulting policy is locked into the consent capture flow so every new admission inherits the same standard.
Belongs to
1 moduleWhat’s new
1 updateFrequently asked
8 questionsIs the Inkwelly consent record actually compliant with the DPDP Act 2023?
Yes. The record is per-parent, per-channel, per-purpose; captured digitally at admission with the parent's typed name and SMS verification; append-only so older states are never overwritten; revocable through the parent app, a STOP reply or an email unsubscribe link (the DPDP Act requires withdrawal to be as easy as grant); and stored on servers in Mumbai per the Act's data-localisation provisions. The schools using Inkwelly have produced consent exports for both Data Protection Board inquiries and CBSE renewal audits without follow-up queries.
What happens to a parent's existing consent when our school adopts Inkwelly?
Existing parents are migrated under a transitional rule — transactional messages and OTP login codes are allowed on the implicit-consent assumption (because the parent has been receiving these all along, which the DPDP Act recognises as a legitimate basis for continuation), but promotional messages are blocked until the parent explicitly opts in. A guided one-click re-capture flow on the parent app and admission portal collects the explicit consent typically within the first term.
Inkwelly me parent ka STOP reply kaise process hota hai?
जब parent WhatsApp पर STOP, UNSUBSCRIBE या BAND KARO reply करते हैं, keyword automatically detect होते हैं और consent record कुछ seconds के अंदर update हो जाता है। Parent promotional sends से unsubscribe हो जाते हैं — अगली alumni broadcast या fundraising message उन तक नहीं जाएगी। Transactional messages (fee receipts, attendance alerts) चलते रहते हैं क्योंकि parent ने उन से unsubscribe नहीं किया। STOPALL keyword से हर promotional channel se unsubscribe ho jaate hain।
Can a parent opt out of fee receipts and attendance alerts?
By default, no — transactional consent is required for the school's day-to-day functioning, and the DPDP Act 2023 recognises legitimate-use messages (such as billing receipts and education-related notifications) as a separate purpose from promotional. A parent who explicitly wants to stop receiving transactional WhatsApp can switch to SMS or email through the parent app, but cannot turn off transactional communication on every channel entirely. Promotional consent, on the other hand, can be revoked at any time on any channel.
Kya OTP login codes consent record ko follow karte hain?
नहीं। OTP login codes हमेशा जाते हैं, consent state कुछ भी ho. यह TRAI के DLT framework और Meta की WhatsApp policy दोनों की requirement है — regulator expect karta hai ki OTP parent tak pahunche, chaahe quiet hours hon ya unsubscribe state ho. Inkwelly OTP ko ek alag purpose mark karta hai taki yeh exception transparent aur auditable rahe, hidden nahi.
Can the school's super-admin delete a consent row to clean up the audit trail?
No. The consent record is append-only at the database level — the application does not expose any delete operation, not even for the super-admin. This is by design, because the DPDP Act 2023 expects the school to prove the parent's consent state at the time a message was sent, and the only way to do that reliably is to make the historical record immutable. If a row was added in error (very rare), the school adds a corrective new row explaining the error; the original row is preserved.
Does the consent record cover student consent too, or only parent consent?
Both. Students above the age threshold the school configures (typically 18 years, the DPDP Act 2023's adult threshold) have their own consent record once they have their own contact details on file; below the threshold, the parent's consent applies for the student. The school can configure the threshold to match its student population (some boarding schools use 16 with explicit parental override, some primary schools defer student consent entirely until passing-out). The transition from parent-consent to student-consent at the threshold is automatic and audit-logged.
How long is the consent record retained after a parent leaves the school?
For the lifetime of the school's Inkwelly account, by default. The DPDP Act 2023 allows a Data Protection Board inquiry years after the fact, and the school may need to produce evidence of what the parent's consent state was at the time a particular message was sent in the past. The append-only consent record is the school's protection in such an inquiry. If the school explicitly chooses to purge older parents from the active database (after a configurable period such as seven years post-leaving), an audit row preserves the fact and the date of the purge for regulator review.
You might also like
2 readsSee Inkwelly on your school
30-minute demo. We open your current ERP with you and load your data into Inkwelly on the call. Dated go-live plan by the end of it.