Resources Categories
INDUSTRY FACT FILE · EDUCATION, EDTECH & RESEARCH
Industry Overview: Education, Edtech and Research in India
Who educates, examines and researches in India, the obligations that apply, who buys cybersecurity and why each type of institution and platform needs a distinct approach.
|
In this document 1. Why education and research cybersecurity matters now 2. The ecosystem at a glance 3. Categories of education, edtech and research organisations 4. The regulatory, policy and standards framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside an institution or platform 7. Why each type of institution needs a different approach 8. How Codec Networks works with education and research organisations |
|
Sector scope Sector: university groups and deemed universities, school chains, coaching and test-prep, online learning and edtech platforms, examination bodies and testing agencies, research organisations and laboratories. Primary service proposition: student data privacy, LMS and examination security, research IP protection, SOC and awareness. Healthcare, IT services, SaaS, media and government have separate fact files. |
1. Why education and research cybersecurity matters now
India runs the largest education system in the world. UDISE+ 2023-24 counts about 24.8 crore school students in 14.72 lakh schools taught by 98 lakh teachers; the All India Survey on Higher Education puts higher-education enrolment at about 4.5 crore in 2023-24, with a gross enrolment ratio of 30 that the National Education Policy 2020 aims to raise to 50 by 2035. Around this core sit coaching and test-prep businesses serving tens of lakhs of aspirants, edtech platforms that reached crores of learners during and after the pandemic, boards and testing agencies that conduct examinations for lakhs of candidates on a single day, and research organisations whose output is now funded through the Anusandhan National Research Foundation with a ₹50,000 crore envelope for 2023-28. The Union Budget 2025-26 allocated about ₹1.28 lakh crore to the Ministry of Education.
|
24.8 crore School students in India (UDISE+ 2023-24) |
4.5 crore Higher-education enrolment (AISHE 2023-24) |
3rd Most targeted industry worldwide in 2024 (Microsoft) |
6 hours To report cyber incidents to CERT-In |
This system has become digital in less than a decade. Admissions, fees, attendance and transport run on ERP and student information systems; teaching runs on learning management systems, video classes and mobile apps; examinations depend on question banks, computer-based testing, proctoring software and result portals; credentials flow through DigiLocker, the APAAR identifier and the Academic Bank of Credits; and research depends on grant systems, shared data sets, journals accessed through One Nation One Subscription and high-performance computing. Each of these systems holds personal data about children and young adults, or controls something whose integrity matters to lakhs of people. Microsoft's Cyber Signals report ranked education the third most targeted industry globally in 2024, and Sophos found that 66 per cent of higher-education and 63 per cent of lower-education organisations surveyed had been hit by ransomware in the preceding year.
The consequences are visible in India and abroad. In May 2020 about 22 million Unacademy user records were offered for sale after a breach; in 2023 a security researcher found a misconfigured server at Byju's exposing student and loan records; in 2024 the NEET-UG paper leak led the Supreme Court to confirm that the leak at Hazaribagh and Patna was real even while declining a nationwide retest, the UGC-NET June 2024 examination was cancelled a day after it was held, and a new criminal law on unfair means in public examinations came into force. Abroad, the University of California San Francisco paid about US$1.14 million to ransomware operators in 2020, Lincoln College in Illinois closed in 2022 after a cyberattack compounded pandemic losses, and the PowerSchool breach of December 2024 exposed tens of millions of student and teacher records held by a single school-software vendor.
In India the obligations are layered. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be kept for 180 days; its 2025 audit policy guidelines expect risk-based, independent audits. The DPDP Act and Rules make institutions and platforms data fiduciaries for the data of students, parents and staff, and set special rules for children: verifiable parental consent and a bar on tracking, behavioural monitoring and targeted advertising, with purpose-limited exemptions for educational institutions and most obligations taking effect in May 2027. The Public Examinations (Prevention of Unfair Means) Act, 2024 criminalises leaks and unfair means, including by service providers, and Parliament passed an amendment with higher penalties in July 2026. UGC, AICTE, CBSE and state boards set institutional expectations; listed education companies disclose cyber incidents under SEBI's LODR Regulations; and sponsors, collaborators and school customers increasingly audit security before signing.
|
Key takeaway In education, cybersecurity is the privacy of children and young adults, the integrity of examinations and the protection of research in one. Student records, learning platforms, examination systems and laboratories must be protected together, and the people who use them must be trained. |
2. The ecosystem at a glance
Figure 1: India's education, edtech and research ecosystem.
3. Categories of education, edtech and research organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
University groups and deemed universities |
Multi-campus universities, deemed and private universities, affiliated college networks |
State and central governments, trusts, societies, private groups |
UGC and AICTE regulations; NAAC; CERT-In; DPDP; NCIIPC rarely |
|
Professional and technical colleges |
Engineering, medical, management and law colleges with entrance-driven admissions |
Trusts, societies and private groups; some public |
AICTE, NMC, BCI and university rules; CERT-In; DPDP |
|
School chains and boards |
K-12 chains, international schools, state and central boards |
Trusts, societies, corporate groups, governments |
Board affiliation rules; RTE; DPDP children's provisions; CERT-In |
|
Coaching and test-prep |
Entrance and competitive-exam coaching, offline centres and apps |
Private companies, some listed or venture-backed |
Coaching centre guidelines 2024 and state laws; DPDP; CERT-In; SEBI LODR if listed |
|
Online learning and edtech platforms |
K-12 apps, higher-education and upskilling platforms, MOOCs, tutoring marketplaces |
Venture-backed and listed companies, public platforms such as SWAYAM |
DPDP including children's data; IT Rules 2021 where intermediaries; CERT-In; SEBI LODR if listed |
|
Examination bodies and testing agencies |
NTA, boards, recruitment and university examination wings, computer-based testing providers |
Government agencies and their private service providers |
Public Examinations Act 2024; agency rules; CERT-In; DPDP |
|
Research organisations and laboratories |
Public research institutes, university labs, private R&D and industry-sponsored centres |
Government, universities, private companies |
ANRF and funder conditions; sponsor contracts; export-control and security clearances where relevant; CERT-In |
|
Education technology vendors |
LMS, ERP, proctoring, assessment and hosting providers |
Private companies, Indian and global |
Customer contracts; DPDP as processors; SOC 2 and ISO 27001 as market expectations |
4. The regulatory, policy and standards framework at a glance
|
Instrument or expectation |
What it means for institutions and platforms |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering infrastructure, cloud and applications, with closure of findings—relevant to campuses, platforms and examination systems |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notices, consent, safeguards, retention limits and breach intimation for student, parent, alumni and staff data; verifiable parental consent for children and a bar on tracking and targeted advertising, with purpose-limited exemptions for educational institutions; most obligations from May 2027 |
|
Public Examinations (Prevention of Unfair Means) Act 2024 |
Criminal offences for leaks, unfair means and collusion in public examinations, with liability for service providers; in force since June 2024 and strengthened by an amendment passed by Parliament in July 2026 |
|
UGC, AICTE, NMC and boards |
Institutional approval, affiliation and accreditation conditions, examination conduct norms and online-education regulations; the Viksit Bharat Shiksha Adhishthan Bill, 2025 proposes a single regulator |
|
Coaching centre guidelines (January 2024) |
Registration, no enrolment below 16 years, conduct and transparency conditions adopted through state rules |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023 |
|
Funder, sponsor and customer requirements |
Grant conditions, collaboration agreements, school and university procurement questionnaires, SOC 2 and ISO/IEC 27001 expectations for vendors |
|
How these apply Cyber obligations are cross-sector and depend on institution type, data handled, listing status and contracts; examination-integrity law applies to the bodies and service providers named in it. Confirm against the official instruments and your agreements. |
5. Government, public-sector and private participants
- The Ministry of Education sets policy and runs NEP 2020, Samagra Shiksha, DIKSHA, SWAYAM, APAAR and the Academic Bank of Credits; UGC, AICTE and NCTE regulate higher, technical and teacher education, with a single regulator proposed.
- The National Testing Agency, CBSE, state boards and recruitment bodies conduct examinations for lakhs of candidates; the Radhakrishnan committee recommended testing reforms in October 2024.
- MeitY and CERT-In set cyber obligations; the Data Protection Board will enforce DPDP; SEBI governs listed-company disclosure.
- ANRF, DST, CSIR, ICMR and DRDO fund and run research; One Nation One Subscription provides journal access to more than 6,300 institutions.
- Public and private universities, school chains, coaching companies and edtech platforms deliver most teaching, with venture and public-market investors behind the private side.
- LMS, ERP, proctoring, cloud and payment vendors build and host the systems institutions depend on, and are often the weakest link.
6. Who buys cybersecurity inside an institution or platform
|
Stakeholder |
What they care about |
What they buy |
|
Board of trustees, Vice-Chancellor, CEO and CFO |
Reputation, student trust, examination integrity, disclosure |
Board advisory, resilience programmes, crisis exercises |
|
CIO, CISO and IT heads |
Campus and cloud security, audits, vendor risk |
Audits, assessments, SOC, GRC programmes |
|
Controller of Examinations and testing heads |
Question banks, centres, evaluation, results |
Examination-system testing, integrity controls, drills |
|
Registrars, admissions and finance |
Student records, fees, scholarships, fraud |
ERP security, payment controls, DPDP |
|
Deans of research and lab directors |
Research data, sponsor confidentiality, collaborations |
Data classification, segmentation, threat hunting |
|
Edtech product and engineering leads |
App, API and cloud security, SOC 2, investor diligence |
VAPT, DevSecOps, cloud posture, SOC 2 readiness |
|
Principals, school heads and parent-facing teams |
Children's data, safeguarding, parent communication |
Privacy programmes, awareness, incident communication |
7. Why each type of institution needs a different approach
|
Institution type |
Highest-consequence risk |
Starting point for assurance |
|
University groups |
Ransomware across campus ERP and LMS; grade and research data integrity |
Segmentation, backup testing, LMS and ERP assessment, SOC |
|
School chains |
Breach of children's data and fee fraud against parents |
DPDP programme, ERP and payment controls, parent awareness |
|
Coaching and test-prep |
App and portal breaches of large candidate bases; account takeover |
Web, mobile and API testing, identity controls, SOC |
|
Edtech platforms |
Cloud misconfiguration, SDK tracking of children, investor and customer diligence |
Cloud posture, privacy-by-design, SOC 2 and ISO 27001 |
|
Examination bodies |
Paper and question-bank compromise, candidate-data leaks, results-day outages |
Exam-system testing, integrity controls, surge monitoring, crisis drills |
|
Research organisations |
Espionage and theft of research data and IP |
Data classification, segmented labs, threat hunting, collaborator agreements |
8. How Codec Networks works with education and research organisations
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For education, edtech and research organisations we deliver DPDP programmes built for children's and students' data, LMS, portal, app and examination-system testing, research-protection programmes with segmentation and threat hunting, 24x7 managed SOC with coverage for admissions and results periods, phishing and scam awareness for staff, students and parents, and crisis exercises with leadership—planned around the academic calendar and connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by institution type, regulator, board, listing status, funding source and contracts; confirm them against the official CERT-In, MeitY, Ministry of Education, UGC, AICTE, SEBI and examination-authority instruments and your own agreements.