DPDP Act · Section 9 · Rules 10–12
Parental consent under the DPDP Act: what organisations need to get right
If your service handles a child’s digital personal data, the consent flow needs to involve a parent in a way your organisation can verify and explain. That affects account creation, age checks, product design and the data you keep as evidence.
01 · The baseline
Children need stronger safeguards in the service itself
The DPDP Act defines a child as an individual who has not completed eighteen years of age. Section 9 generally requires a Data Fiduciary to obtain verifiable consent from the parent before processing a child’s personal data.
It also prohibits processing likely to cause a detrimental effect on a child’s well-being, and generally restricts tracking or behavioural monitoring of children and targeted advertising directed at them, subject to the Act’s prescribed exceptions.
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 corrected the wording of section 9(1) to distinguish children from persons with disabilities who have a lawful guardian. The child-related rule remains a distinct requirement.
Sources: section 9 of the DPDP Act and 2026 Removal of Difficulties Order.
02 · Rule 10
Verification should establish adulthood without collecting more than needed
Rule 10 asks the Data Fiduciary to use appropriate technical and organisational measures and do due diligence to check that the person identifying as a parent is an adult and identifiable when needed for compliance with law.
Check reliable details already held
Where the parent has previously provided reliable identity and age details to the service, the organisation can use those details to make the required check.
Offer an appropriate verification route
Rule 10 permits details voluntarily provided by the individual or an authorised entity’s virtual token mapped to identity and age details. Digital Locker service provider details are included in the Rule.
Keep evidence proportionate
Record the consent, purpose, time and verification method needed to demonstrate the process. Design access and retention controls for the evidence you keep.
03 · Rules 11–12
Exemptions are narrow and tied to conditions
Rule 12 and the Fourth Schedule exempt certain processing from section 9(1) and 9(3), but only for the specified class or purpose and within the stated limits. Examples include health services necessary to protect a child’s health, education-related tracking or safety monitoring by an educational institution, and location tracking by a school transport provider during travel to or from the institution for safety.
The Schedule also lists specified purposes such as real-time location for a child’s safety and certain child welfare services. These exceptions do not create a general exemption for an organisation just because it serves children.
The prohibition on processing likely to cause a detrimental effect on a child’s well-being is a separate obligation. Keep the purpose, relevant Schedule condition and decision-maker recorded for each exemption relied on.
04 · Put it into practice
Build safeguards into product and operations
A parental consent checkbox on its own does not answer the questions raised by a child-facing service. Map how a child enters the service, what data is collected next and which partners receive it.
Before launch
Map child data and purposes; decide how age and parent status are established; make parent-facing notices clear; disable prohibited tracking and targeted ads; and review vendors, analytics and product defaults.
During use
Store a traceable consent receipt; provide a practical way to withdraw or change choices; route requests to an owner; limit staff access; and check that processors follow the same instructions.
Related: DPDP guidance for schools, edtech platforms and the data rights portal guide.
05 · Phased commencement
When do these child data requirements take effect?
Section 9 and Rules 10–12 are scheduled to commence eighteen months after the notification dated 13 November 2025. The 2026 wording correction is already in force; it does not change this scheduled date for section 9.
Check the commencement notification and the 2026 Removal of Difficulties Order on MeitY.
Questions teams ask
Parental consent FAQs
What age counts as a child under the DPDP Act?
A child is an individual who has not completed eighteen years of age.
Does every use of a child’s data need parental consent?
Section 9 sets the general rule, while Rule 12 and the Fourth Schedule provide limited exemptions for specified classes or purposes. Whether an exemption applies depends on the exact processing and its conditions.
Can a school use children’s data without parental consent?
The Fourth Schedule provides a limited exemption for an educational institution’s tracking and behavioural monitoring for educational activities or child safety. It is not a general exemption for all school processing or public sharing of student information.
Is a parent’s identity document always required?
Rule 10 permits checking reliable identity and age details already held by the Data Fiduciary or details voluntarily provided through permitted means. Design a proportionate verification step for your circumstances.
Make child data choices clear to parents
Review your organisation’s processes and identify where age checks, consent evidence or product safeguards need attention.