Rule 11
Rule 11 guardian consent for persons with disability
When a person with disability has a lawful guardian, s.9(1) requires the guardian's verifiable consent. Rule 11 says what to check before you accept it.
Short answer
Section 9(1) of the DPDP Act requires the verifiable consent of the lawful guardian before processing the personal data of a person with disability who has a lawful guardian. Under Rule 11, before accepting that consent, the Data Fiduciary must verify that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law. Rule 11 starts on 13 May 2027.
When Rule 11 applies
Section 9(1) requires verifiable consent of the lawful guardian before processing the personal data of a person with disability who has a lawful guardian. Under s.2, the Data Principal for such a person includes the lawful guardian acting on their behalf.
Rule 11 applies where a lawful guardian exists. Where a person with disability has no lawful guardian, s.9(1) does not call for a guardian's consent, and the usual consent rules in s.6 apply. Rule 11 starts on 13 May 2027 (Rule 1).
Because the Data Principal includes the lawful guardian acting on the person's behalf (s.2), the guardian can also make requests and raise grievances for them. Verify the guardian's authority before acting, just as you would before accepting consent.
What Rule 11 asks you to verify
Before accepting consent from someone who says they are the lawful guardian, the Data Fiduciary verifies that the guardian was appointed, under the applicable guardianship law, by:
- a court;
- a designated authority; or
- a local level committee.
Keep the verification record separate from the consent itself, so you can show both if asked.
Rule 11 is about the guardian's appointment, not the person's medical details. Ask only for what you need to verify the appointment, and check with counsel which guardianship law applies to your users. If the documents leave doubt, do not treat the consent as verified; ask for more or escalate to your DPO or counsel.
A verification flow that respects the person
- 01Ask for the appointment
Ask the guardian for details of the appointment and the body that made it.
- 02Check the appointing body
Confirm it is a court, a designated authority or a local level committee under the applicable law.
- 03Record the check
Keep a record of what you checked, when and by whom, alongside the consent.
- 04Make it accessible
Design forms and messages so both the person and the guardian can follow them.
- 05Allow withdrawal
The guardian can withdraw consent at any time, as easily as it was given (s.6(4)).
- 06Review on change
Check again if you learn the appointment has ended or changed, and keep the new verification with the consent record.
How Rule 11 differs from Rule 10
| Point | Rule 10: child | Rule 11: person with disability |
|---|---|---|
| Who consents | A parent | The lawful guardian |
| What you check | That the parent is an identifiable adult, using identity and age details you hold, details the parent gives, or a virtual token mapped to such details | That the guardian was appointed by a court, a designated authority or a local level committee |
| Underlying duty | s.9(1) | s.9(1) |
| Starts | 13 May 2027 | 13 May 2027 |
Both sit under s.9; see children's data under section 9 for the rest of the section.
The Removal of Difficulties Order changed wording only
The Removal of Difficulties Order, 2026 (S.O. 5458(E), Gazette 6 October 2026) inserted “of” in s.9(1), so it reads “a child or of a person with disability”. The change is editorial. Persons with disability who have a lawful guardian were already covered by s.9(1); the Order did not extend s.9 to them. More in our note on the Order.
How TruePrivacy helps
The guardian consent flow in children's data creates a request, notifies the guardian by email, has the guardian verify with a code, and records the decision with a timeline and evidence. Consent can be revoked, and a request expires if the guardian does not decide in time.
The email code confirms the guardian controls that address; it is not the Rule 11 appointment check, which your team carries out and records. The privacy center gives guardians a self-service route to submit requests and check their status.
Who counts as a lawful guardian under Rule 11?
A guardian appointed by a court, a designated authority or a local level committee under the applicable guardianship law.
Does Rule 11 apply to every person with a disability?
No. Section 9(1) and Rule 11 apply to a person with disability who has a lawful guardian. Others give consent themselves under s.6.
Did the October 2026 Order extend s.9 to persons with disability?
No. S.O. 5458(E) only inserted “of” in s.9(1). Persons with disability who have a lawful guardian were already covered.
When does Rule 11 start?
On 13 May 2027, with the other core obligations (Rule 1).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin