Verifiable consent first
The Fiduciary must obtain verifiable consent of the parent or lawful guardian before processing any personal data of a child. The same applies to a person with disability who has a lawful guardian. A child is anyone under 18. Rules 10 and 11 set how that consent is checked.
Sources: Act s.9(1)Act s.2(f)Rules r.2(1)(d)
Checking the parent (Rule 10)
The Fiduciary must use appropriate technical and organisational measures and due diligence to check that the person claiming to be the parent is an identifiable adult, meaning 18 or over. It can rely on reliable identity and age details it already holds, or details the person provides voluntarily.
Those details can come directly, or through a virtual token mapped to them and issued by an authorised entity. That entity may be a body entrusted by law or government, or a person it appoints. Details verified through a Digital Locker service provider also qualify. The Rules' examples cover parents who are existing users and parents new to the platform.
Sources: Rules r.10
Checking a lawful guardian (Rule 11)
For a person with disability, the Fiduciary must check that the guardian was appointed under the applicable guardianship law. The appointment may be by a court or by a designated authority under the Rights of Persons with Disabilities Act, 2016. It may also be by a local level committee under the National Trust Act, 1999.
Sources: Rules r.11
What is never allowed
A Fiduciary must not process data in a way likely to cause any detrimental effect on a child's well-being. It must not track or behaviourally monitor children, or target advertising at them. Breaching the additional duties on children can attract a penalty of up to Rs 200 crore.
Sources: Act s.9(2)Act s.9(3)Act Schedule item 3
Exemptions (Rule 12, Fourth Schedule)
Rule 12 lifts the verifiable consent duty and the tracking and advertising bar, but not the well-being duty, for listed cases. Part A lists classes, each for a limited purpose. They are clinical and mental health establishments and healthcare professionals, allied healthcare professionals, educational institutions, creches and day care centres, and school transport providers.
Part B lists purposes: legal functions in a child's interest, State subsidies and benefits, and an email-only user account. It also covers tracking real-time location for safety, keeping harmful content and ads away from a child, and confirming a user is not a child. Each is limited to what is necessary.
Sources: Act s.9(4)Rules r.12Rules Fourth Schedule
Key points
- A child is anyone under 18.
- Get verifiable consent from a parent or lawful guardian first.
- Check the parent is an identifiable adult; tokens and Digital Locker help.
- No tracking, behavioural monitoring or targeted ads at children.
- Fourth Schedule exemptions never lift the well-being duty.
In practice
A checklist for your organisation.
- Ask for age before creating any account.
- Offer parents verification using held details or a Digital Locker token.
- Switch off ad targeting and behavioural profiling for child accounts.
- Record which Fourth Schedule exemption applies, if you rely on one.
Check what you learned
5 questions. Choose an answer to see why it is right.
0 of 5 answered
Question 1 of 5
Whose consent is needed before a child's personal data is processed?
Show the answer
D. The parent or lawful guardian's, by verifiable consent
Section 9(1) requires verifiable consent of the parent or lawful guardian before processing any personal data of a child.
Act s.9(1)Section 9(1) requires verifiable consent of the parent or lawful guardian before processing any personal data of a child.
Act s.9(1)Question 2 of 5
Under Rule 10, what must the Fiduciary check about the person who says she is the parent?
Show the answer
A. That she is an identifiable adult
Rule 10(1) requires due diligence to check that the individual identifying herself as the parent is an adult who is identifiable.
Rules r.10(1)Rule 10(1) requires due diligence to check that the individual identifying herself as the parent is an adult who is identifiable.
Rules r.10(1)Question 3 of 5
Which is prohibited under section 9(3)?
Show the answer
A. Targeted advertising directed at children
Section 9(3) bars tracking or behavioural monitoring of children and targeted advertising directed at children.
Act s.9(3)Section 9(3) bars tracking or behavioural monitoring of children and targeted advertising directed at children.
Act s.9(3)Question 4 of 5
A school monitors pupils' behaviour for its educational activities. What applies?
Show the answer
A. Part A of the Fourth Schedule exempts it from s.9(1) and s.9(3), limited to that purpose
Rule 12(1) and Fourth Schedule Part A item 3 lift s.9(1) and s.9(3) for educational institutions, restricted to tracking for educational activities or safety.
Rules r.12, Fourth Schedule Part ARule 12(1) and Fourth Schedule Part A item 3 lift s.9(1) and s.9(3) for educational institutions, restricted to tracking for educational activities or safety.
Rules r.12, Fourth Schedule Part AQuestion 5 of 5
Under Rule 11, who can appoint a lawful guardian of a person with disability?
Show the answer
A. A court, a designated authority or a local level committee
Rule 11(1) requires checking that the guardian is appointed by a court of law, a designated authority or a local level committee.
Rules r.11(1)Rule 11(1) requires checking that the guardian is appointed by a court of law, a designated authority or a local level committee.
Rules r.11(1)
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.