One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: Collecting and sharing minors' personal data in India, especially a child's home address, requires verifiable parental consent for every participant below 18, not just the youngest ones. A student pen-pal project can be run lawfully, but only with real consent records, a stated purpose, security safeguards, a deletion policy and a screened grievance route. The hardest problem is structural: once you have emailed one child's address to another, you cannot take it back, and no consent form fixes