# Lesson 7: Children and persons with disability | Learn DPDP | FOCTTA > Extra protection for children under 18 and persons with disability: verifiable consent of a parent or guardian, and limits on tracking and ads. Web page: https://foctta.com/learn/children-and-disability This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 7 Lesson 7 of 12 · 6 min read # Children and persons with disability Extra protection for children under 18 and persons with disability: verifiable consent of a parent or guardian, and limits on tracking and ads. Jump to the quiz ## Where things stand - Not yet in force. Section 9 and Rules 10, 11 and 12 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - No notification under section 9(5), setting an exempt age for verifiably safe processing, was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## Verifiable consent first The Fiduciary must obtain verifiable consent of the parent or lawful guardian before processing any personal data of a child. The same applies to a person with disability who has a lawful guardian. A child is anyone under 18. Rules 10 and 11 set how that consent is checked. Sources: Act s.9(1) Act s.2(f) Rules r.2(1)(d) ## Checking the parent (Rule 10) The Fiduciary must use appropriate technical and organisational measures and due diligence to check that the person claiming to be the parent is an identifiable adult, meaning 18 or over. It can rely on reliable identity and age details it already holds, or details the person provides voluntarily. Those details can come directly, or through a virtual token mapped to them and issued by an authorised entity. That entity may be a body entrusted by law or government, or a person it appoints. Details verified through a Digital Locker service provider also qualify. The Rules' examples cover parents who are existing users and parents new to the platform. Sources: Rules r.10 ## Checking a lawful guardian (Rule 11) For a person with disability, the Fiduciary must check that the guardian was appointed under the applicable guardianship law. The appointment may be by a court or by a designated authority under the Rights of Persons with Disabilities Act, 2016. It may also be by a local level committee under the National Trust Act, 1999. Sources: Rules r.11 ## What is never allowed A Fiduciary must not process data in a way likely to cause any detrimental effect on a child's well-being. It must not track or behaviourally monitor children, or target advertising at them. Breaching the additional duties on children can attract a penalty of up to Rs 200 crore. Sources: Act s.9(2) Act s.9(3) Act Schedule item 3 ## Exemptions (Rule 12, Fourth Schedule) Rule 12 lifts the verifiable consent duty and the tracking and advertising bar, but not the well-being duty, for listed cases. Part A lists classes, each for a limited purpose. They are clinical and mental health establishments and healthcare professionals, allied healthcare professionals, educational institutions, creches and day care centres, and school transport providers. Part B lists purposes: legal functions in a child's interest, State subsidies and benefits, and an email-only user account. It also covers tracking real-time location for safety, keeping harmful content and ads away from a child, and confirming a user is not a child. Each is limited to what is necessary. Sources: Act s.9(4) Rules r.12 Rules Fourth Schedule ## Key points - A child is anyone under 18. - Get verifiable consent from a parent or lawful guardian first. - Check the parent is an identifiable adult; tokens and Digital Locker help. - No tracking, behavioural monitoring or targeted ads at children. - Fourth Schedule exemptions never lift the well-being duty. ## In practice A checklist for your organisation. - Ask for age before creating any account. - Offer parents verification using held details or a Digital Locker token. - Switch off ad targeting and behavioural profiling for child accounts. - Record which Fourth Schedule exemption applies, if you rely on one. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Whose consent is needed before a child's personal data is processed? - The school's - The child's own - The Board's - The parent or lawful guardian's, by verifiable consent Show the answer **D. The parent or lawful guardian's, by verifiable consent** Section 9(1) requires verifiable consent of the parent or lawful guardian before processing any personal data of a child. Act s.9(1) 2. Question 2 of 5 ### Under Rule 10, what must the Fiduciary check about the person who says she is the parent? - That she is an identifiable adult - Nothing - That she has a bank account - That she lives in the same city Show the answer **A. That she is an identifiable adult** Rule 10(1) requires due diligence to check that the individual identifying herself as the parent is an adult who is identifiable. Rules r.10(1) 3. Question 3 of 5 ### Which is prohibited under section 9(3)? - Targeted advertising directed at children - Showing a privacy notice - Answering a grievance - Sending a child's parent a receipt Show the answer **A. Targeted advertising directed at children** Section 9(3) bars tracking or behavioural monitoring of children and targeted advertising directed at children. Act s.9(3) 4. Question 4 of 5 ### A school monitors pupils' behaviour for its educational activities. What applies? - Part A of the Fourth Schedule exempts it from s.9(1) and s.9(3), limited to that purpose - It is always banned - It needs Board approval first - The Act does not apply to schools Show the answer **A. Part A of the Fourth Schedule exempts it from s.9(1) and s.9(3), limited to that purpose** Rule 12(1) and Fourth Schedule Part A item 3 lift s.9(1) and s.9(3) for educational institutions, restricted to tracking for educational activities or safety. Rules r.12, Fourth Schedule Part A 5. Question 5 of 5 ### Under Rule 11, who can appoint a lawful guardian of a person with disability? - A court, a designated authority or a local level committee - Any relative - A Consent Manager - The Data Fiduciary Show the answer **A. A court, a designated authority or a local level committee** Rule 11(1) requires checking that the guardian is appointed by a court of law, a designated authority or a local level committee. Rules r.11(1) Try again[Next lesson: Significant Data Fiduciaries](https://foctta.com/learn/significant-data-fiduciaries) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 6 **Duties of a Data Fiduciary**](https://foctta.com/learn/fiduciary-duties) [Lesson 8 → **Significant Data Fiduciaries**](https://foctta.com/learn/significant-data-fiduciaries) **In this lesson** 1. Where things stand 2. Verifiable consent first 3. Checking the parent (Rule 10) 4. Checking a lawful guardian (Rule 11) 5. What is never allowed 6. Exemptions (Rule 12, Fourth Schedule) 7. Key points 8. In practice 9. Quiz Take the quiz