Fill your coaching batches without buying student data

TNEA's round three choice filling ran from 17 to 19 August. Tentative allotment lands on 21 August, the general counselling cycle is winding down, and a supplementary round for the seats nobody took will follow, the way one did in 2025.

So the next few weeks are when a student who missed the engineering seat they wanted starts thinking about a repeat year, a long-term NEET batch, TNPSC coaching, or bank exam classes. Your enquiry volume is about to move.

Here is what a lot of centres do with that window. They buy a list.

That is not a hypothetical. As of August 2026, studentdatabaseindia.com sells a product called "Tamil Nadu 12th Std All Group & District Wise 2026": 795,530 records in an Excel file, with district, sub-district, student name, father's name, gender, community, mobile number, group, address, pincode and school name. The same vendor sells separate NEET and JEE candidate databases. IndiaMART carries listings for Tamil Nadu 10th standard student data. The market is open, priced, and easy to find.

Then the file goes into a WhatsApp blaster, and 795,530 people who have never heard of your centre receive an admission offer.

ThrivePro builds the opposite of this, and not out of squeamishness. Consented inbound converts better now, and it is the version that still works after 2027.

Is buying a student mobile number list legal in India right now?

Buying the file is not what will hurt you first. Sending to it is. Blasting purchased numbers already breaks WhatsApp's opt-in policy and India's TRAI rules on unsolicited commercial messages, both enforceable today. The DPDP Act's consent obligations arrive in May 2027, so this is a deadline, not permission.

Most coverage of this gets the order wrong. It opens with data protection law and a very large penalty number, which makes the whole thing feel like a 2027 problem. The 2027 part is real and it is covered below. But the rule that can take your centre offline during admission season is already switched on.

What breaks first is your WhatsApp number

Read Meta's own requirement. Before a business messages anyone on WhatsApp, Meta's business messaging policy requires two things: that the person "have given their mobile phone number", and that the business has "received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from a particular business". The opt-in has to name the business the person is opting in to.

A bought list fails the first condition before you get anywhere near the second. Nobody in that Excel file gave you their number. They gave it to a school registration form.

Meta is direct about what happens next. People "can also block or report a business", and "our systems will rate limit businesses if the business's quality is low for a sustained period of time". Blocks and spam reports are the input. Your sending capacity is the output.

The telecom side tightened at the same time. TRAI's February 2025 amendment to the commercial communications regulations cut the complaint threshold for action against a sender from ten complaints in seven days to five complaints in ten days, and cut the time an access provider has to act against an unregistered sender from thirty days to five (S.S. Rana & Co., March 2026). Five complaints against your centre, out of 795,530 sends, inside ten days.

Now price the downside properly. Your centre's WhatsApp number is not a marketing channel you can swap out. It is where a parent asks whether the Sunday batch has moved, where last year's students send their results, where your counsellors do most of their real work. Losing that number in the middle of an admission window costs more than any purchased list has ever earned.

When do India's DPDP consent rules actually start applying?

Not yet. The DPDP Rules were notified in the Gazette on 14 November 2025 with a phased runway. The Consent Manager framework goes live in November 2026, and the substantive notice and consent obligations become enforceable eighteen months from notification, in May 2027. Until then your live exposure is telecom and platform rules, not DPDP.

That runway is the argument, not the excuse. Two things follow from it.

First, get the penalty figure right, because the wrong one is quoted everywhere. Processing someone's phone number without consent or another lawful basis is not a security failure, so it does not sit in the ₹250 crore tier. That ceiling in the Schedule to the DPDP Act applies specifically to a data fiduciary failing to take reasonable security safeguards. A consent or notice violation falls under breach of any other provision of the Act, which is capped at up to ₹50 crore.

Second, look at what you are really buying when you buy provenance you cannot explain. In 2019 the CBI opened a preliminary enquiry into student data theft after both CBSE and coaching centres were named as possible sources, and a Bengaluru broker told ThePrint that they buy student contact details from third-party websites and then solicit those students. In July 2026 Medianama reported that leaked data of Indian students, from government exams and from private coaching institutes, is sold online. Buy the file and you inherit that question. By May 2027 you need an answer to it, and there is not one.

This describes how ThrivePro operates and where the rules are heading. It is not legal advice, and your centre should run its own compliance specifics past its own counsel.

Consented inbound means the parent messages you first

The alternative is unglamorous and it already works: make it easy for the parent or the student to open the WhatsApp thread themselves.

• A QR code on the handout you give outside the exam centre, on your notice board, on the hoarding
• A click-to-WhatsApp button on your Instagram and Google ads, so the ad opens a chat instead of a form
• A "message us on WhatsApp" link on your results page and your fees page
• Your current students and their parents, who already message you

Each of those produces a thread the other person started, with their name attached, at a time you can log, from a number they typed in themselves.

Now compare the two leads honestly. A row in a bought Excel file is a student who wrote their number on a school form eighteen months ago and may already be sitting in a hostel in Kota. A parent who scanned a QR code outside your Anna Nagar branch at 7pm is deciding this week. One of those is a lead. The other is a rounding error you pay for twice, once to the vendor and again in blocks and reports.

How ThrivePro builds this for a coaching centre

ThrivePro sets this up as a managed WhatsApp agent running on Meta's official Cloud API, using your centre's own API token, on a deployment isolated to your centre rather than a shared backend. What it covers:

• Answering enquiries the moment they arrive, including at 10pm on the night a result comes out
• Lead capture with your own fields, so a thread ends with target exam, current class, preferred branch and batch timing written into your CRM
• Number provenance logged on every record, meaning how that number reached you and when consent was established. This is ThrivePro's own operating rule, not an add-on
• Opt-out honoured everywhere, on every channel, the first time someone asks
• Tamil and English, because a parent will switch language mid-sentence
• Handover to a counsellor inside the same chat the moment a question needs a person

The standing rule on the other side of that: ThrivePro does not scrape or buy personal mobile numbers for unsolicited blasts. Not for our own outreach, not for a client's.

What it costs, and when to build it

An enquiry capture and booking agent sits in ThrivePro's CRM capture and booking tier.

• Chennai: around ₹30,000 to ₹50,000 one-time setup, then ₹7,000 to ₹10,000 per month
• Tier-2 Tamil Nadu, so Coimbatore or Madurai or Trichy: ₹15,000 to ₹35,000 setup, then ₹5,000 to ₹7,500 per month

The monthly figure is scoped work rather than a helpline. It covers tuning how the agent handles the way real parents phrase things, managing your WhatsApp API configuration, and keeping the thing up.

Timing matters more here than in any other vertical ThrivePro works in. Build it before your admission window opens, not three days into it. A centre that signs in the last week of its season pays for setup and gets none of the season out of it, which is a bad trade on both sides of the table.

Start with the numbers you can account for

You do not need 795,530 strangers. You need the parents already trying to reach you, answered fast, captured properly, and logged well enough that in May 2027 you can say exactly where every number in your CRM came from.

Book a demo of the coaching WhatsApp agent, and we will set it up against your own admission funnel.