Children's data under DPDP section 9

The duties in s.9

A child is an individual who has not completed eighteen years of age (s.2). For a child, the Data Principal includes the parents or lawful guardian.

Each duty applies on its own. A parent's verifiable consent under s.9(1) does not permit tracking, behavioural monitoring or targeted advertising directed at a child under s.9(3).

Designing products for s.9(2) and s.9(3)

• Decide how you will know that a user is a child, and record that decision.
• Switch off tracking and behavioural monitoring for children, unless a Rule 12 exemption applies within its conditions.
• Keep children out of targeted advertising audiences (s.9(3)).
• Review features for likely detrimental effects on a child's well-being (s.9(2)); Rule 12 does not lift this duty.

Verifying a parent under Rule 10

Rule 10 requires verifiable consent of a parent. The fiduciary checks that the person giving consent is an identifiable adult, using:

• reliable identity and age details it already holds;
• identity and age details the parent provides; or
• a virtual token mapped to such details, for example through a Digital Locker service provider.

Choose the method that fits your service, record which one you used, and keep the evidence. Rule 10 starts on 13 May 2027. Our guide on verifiable parental consent walks through the flows.

Persons with disability who have a lawful guardian (Rule 11)

Section 9(1) also covers persons with disability who have a lawful guardian. Under Rule 11, before accepting the guardian's consent, the fiduciary verifies that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law. See Rule 11.

Exemptions under Rule 12

Under Rule 12, s.9(1) and s.9(3) do not apply to the classes of Data Fiduciaries in Part A of the Fourth Schedule, such as clinical establishments, allied healthcare, educational institutions, crèches and child-care centres, and transport for school children. Nor do they apply to the purposes in Part B, such as age verification, email-only accounts and real-time location for safety.

The Removal of Difficulties Order did not extend s.9

The Removal of Difficulties Order, 2026 (S.O. 5458(E), Gazette 6 October 2026) inserted “of” in s.9(1), so it reads “a child or of a person with disability”. The change is editorial. Persons with disability who have a lawful guardian were already covered by s.9(1), and the Order adds no new duty.

How TruePrivacy helps

Children's data in TruePrivacy runs a guardian consent flow: a request is created, the guardian is notified by email and verifies with a code, and the decision is recorded with a timeline and evidence. Consent can be revoked, and a request expires if the guardian does not decide in time. The DPDP minor age is set at 18.

The email code confirms the guardian controls that address. It is not, on its own, the Rule 10 identity and age check, so record which Rule 10 method you used. Sector notes are in edtech and gaming.