Glossary
Who is a child under DPDP?
Under the DPDP Act, anyone under 18 is a child. Processing a child's personal data brings extra duties under section 9.
Definition
Under s.2 of the DPDP Act, 2023, a child is an individual who has not completed eighteen years of age. Processing a child's personal data needs the verifiable consent of a parent or lawful guardian (s.9(1), Rule 10), must not be likely to cause a detrimental effect on the child's well-being (s.9(2)), and excludes tracking, behavioural monitoring and targeted advertising directed at children (s.9(3)). Rule 12 exempts some classes and purposes within stated conditions.
What it means
Anyone under 18 is a child under DPDP. For a child, the parents or lawful guardian are included in the definition of Data Principal, and consent comes from them as verifiable consent (s.9(1)). See children's data under section 9.
Under Rule 12, s.9(1) and s.9(3) do not apply to the classes of fiduciaries in Part A of the Fourth Schedule (for example clinical establishments, educational institutions and crèches) or the purposes in Part B (for example age verification), each only within the conditions stated there. Read those conditions with counsel.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | A child has not completed eighteen years of age |
| s.9(1), Rule 10 | Verifiable consent of a parent or lawful guardian |
| s.9(2) | No processing likely to cause a detrimental effect on a child's well-being |
| s.9(3) | No tracking, behavioural monitoring or targeted advertising directed at children |
| s.9(4), s.9(5), Rule 12 | Exemptions for Fourth Schedule classes and purposes, within conditions |
Common misconceptions
- “Teenagers can consent for themselves.” Under DPDP anyone under 18 is a child, so a parent's verifiable consent is needed unless a Rule 12 exemption applies.
- “Rule 12 exempts schools and hospitals from everything.” It lifts only s.9(1) and s.9(3), and only within the Fourth Schedule's conditions.
- “The duties already apply.” Rules 10 and 12 begin on 13 May 2027 with the other core obligations.
Related terms
Checked consent of a parent or lawful guardian (s.9(1), Rules 10 and 11).
Data PrincipalThe individual the personal data relates to (s.2).
ConsentFree, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
NoticeThe information that comes with every request for consent (s.5, Rule 3).
In TruePrivacy
Parental consent sends the request to the guardian by email; the guardian verifies with a code, and the decision is recorded with a timeline and evidence. Consent is revocable and expires if the guardian does not decide in time.
What age is a child under DPDP?
Under 18. s.2 defines a child as an individual who has not completed eighteen years of age.
Can a 16-year-old consent under DPDP?
Not on their own. The Data Fiduciary needs the verifiable consent of a parent or lawful guardian (s.9(1)), unless a Rule 12 exemption applies.
Can I show targeted ads to children?
No. s.9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, except where Rule 12 exempts a class or purpose within its conditions.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin