Why CBSE making APAAR mandatory for board exam registration has sparked privacy debate

Automated Permanent Academic Account Registry or APAAR contains a student’s academic record from pre-primary to higher education level. It is part of NEP 2020.

Representational image. A student undergoes biometric check at an examination centre. | ANI

New Delhi: The Central Board of Secondary Education (CBSE) has made it mandatory for students to submit their 12-digit APAAR Ids while registering for their Class 10 and 12 board exams, sparking a debate around data security and privacy.  

The Automated Permanent Academic Account Registry (APAAR) was introduced through the National Education Policy (NEP) 2020. It is an identification number linked to a student’s enrollment and contains details of his or her academic journey. It is a lifelong record of a student’s educational scores, achievements and related statistics, and is voluntary. 

It makes it easier to access their report cards and records through DigiLocker, a digital platform launched by the government where one can store and access one’s documents digitally. 

In 2023, the Ministry of Education wrote to states, asking schools to take the consent of parents to create their wards’ APAAR Ids, since it is still voluntary, under the ‘One Nation, One Student’ scheme launched by the Union government. 

Moreover, the ministry also asked schools to organise parent-teacher meetings, educating parents on the APAAR initiative. To get the APAAR Id made, a student has to submit his or her personal details including name, age, date of birth, gender, photograph and Aadhaar number.

While the government has said the APAAR Id will put an end to fake education certificates, the CBSE move has raised concerns among experts and privacy advocates. 

Critics draw parallels with Aadhaar, which is still voluntary but is required for accessing certain government benefits and subsidies, as well as for linking with PAN cards and for some banking services.

They see linking the APAAR Id with board exam registration as pushing towards its mandatory adoption, and warn of potential risks to privacy, data security, and individual freedom.  

Mishi Choudhary, the founder of Software Freedom Law Centre (SFLC), told ThePrint that Indians are being asked to comply with new forms of identification on a daily basis. “First, Aadhaar was supposed to solve all problems, now children are being tied to APAAR, and parents are being harassed,” she said, claiming that APAAR has no legal or statutory backing.

Choudhary added that the creation of the Id is loosely based on the letter issued by the secretary of the Ministry of Education. “In the absence of legal sanction, it is worrisome to see that schools are being directed to enroll students en masse after forcing parents’ consent,” she said. 

ThePrint reached the CBSE for a comment on the decision through messages and email. This report will be updated if and when a response is received. 

From voluntary to mandatory

Shreeja Sen, an independent tech researcher, highlighted operational and regulatory gaps, questioning the necessity of APAAR given existing systems like DigiLocker.

“Whether all schools have the infrastructure to carry out this mandatory process in an error-free and smooth manner remains to be seen,” she said, adding there needs to be an understanding of what the government wants to achieve by creating these Ids.

“If the goal is to streamline systems then the DigiLocker already does that.  Otherwise, what we end up with is a multitude of IDs, one for education, one for health, all on top of PAN, Aadhaar, passport, and so on,” she said.

Moreover, Sen said that over the years, there has been a trend of digital frauds through Aadhaar and in case of APAAR IDs, without clear regulation or a functioning data protection board, students’ personal and academic records will remain vulnerable.

Srinivas Kodali, another independent researcher, emphasised the risk of over-profiling and “exclusion, particularly for minors”. Centralising vast amounts of children’s sensitive data, from grades to health details, increases the likelihood of breaches, especially given past examples like leaks from the Ministry of Education’s Diksha portal, he said.

In January 2023, an article by Wired said that government-run education platform Diksha had left a Microsoft Azure cloud server unsecured for over a year, exposing sensitive data of millions of teachers and students. The information included full names, contact details, school affiliations, course records, and, in the case of teachers, complete email and phone lists.

Kodali further said such systems require explicit legal backing and proportionate safeguards, as per Supreme Court rulings on privacy. Globally, he said, student profiles from schools have been breached when schools didn’t invest enough in security measures. “This data will leak as it becomes ubiquitous everywhere,” he said.

Harleen Kaur, a researcher working with The Digital Futures Lab (DFL), told ThePrint that APAAR is a part of a broader pattern where state “services” blur into surveillance tools. “Education is a right. Placing education records in a centralised repository is a service,” she said.

Kaur warned that making APAAR practically mandatory undermines the Supreme Court’s Puttaswamy judgment, referring to the landmark 2017 Justice K.S. Puttaswamy (Retd.) vs. Union of India litigation in which the Supreme Court unanimously held that the Right to Privacy is a fundamental right under Article 21 and other parts of the Constitution.

Kaur said making APAAR ID mandatory erodes institutional autonomy. The central storage of both academic and co-curricular achievements could enable intrusive profiling, with consequences for personal freedom, she said.

“Who will take responsibility when that happens? This is why activists treat privacy, data hoarding, and centralisation as urgent concerns rather than abstract ideas,” she said. “As citizens, we cannot allow our right to choose or not to choose a service to be chipped away bit by bit.”

(Edited by Ajeet Tiwari)