Glossary
What is verifiable consent under DPDP?
Verifiable consent is the consent a parent or lawful guardian gives for a child or a person with disability. The Data Fiduciary checks who is giving it.
Definition
Verifiable consent is the consent of a parent or lawful guardian that a Data Fiduciary must obtain under s.9(1) of the DPDP Act, 2023 before processing personal data of a child or of a person with disability who has a lawful guardian. Rule 10 sets how to check a child's parent, and Rule 11 how to check a lawful guardian. Both apply from 13 May 2027.
What it means
Under Rule 10, the Data Fiduciary checks that a child's parent is an identifiable adult using one of three sources: reliable identity and age details it already holds, details the parent provides, or a virtual token mapped to such details. See the verifiable consent guide.
Under Rule 11, before accepting consent from a lawful guardian, it verifies that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.9(1) | Verifiable consent of the parent or lawful guardian |
| Rule 10 | Check the parent is an identifiable adult: details already held, details the parent provides, or a virtual token mapped to such details |
| Rule 11 | Verify the guardian was appointed by a court, a designated authority or a local level committee |
| Rule 12 | s.9(1) does not apply to Fourth Schedule classes and purposes, within their conditions |
| S.O. 5458(E) | Inserts “of” in s.9(1); editorial only |
Common misconceptions
- “Any verification method will do.” Rule 10 lists three ways to check that the parent is an identifiable adult; check your method against them with counsel.
- “The October 2026 Order extended s.9 to persons with disability.” They were already covered by s.9(1); the Order only inserted “of”.
- “Verifiable consent is only about children.” It also covers persons with disability who have a lawful guardian (Rule 11).
Related terms
An individual who has not completed eighteen years of age (s.2).
ConsentFree, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
Data PrincipalThe individual the personal data relates to (s.2).
NoticeThe information that comes with every request for consent (s.5, Rule 3).
In TruePrivacy
Parental consent records a guardian's decision: the request goes to the guardian by email, the guardian verifies with a code, and the decision is kept with a timeline and evidence. It is revocable and expires if the guardian does not decide in time. Check with counsel how your verification steps map to Rule 10 or Rule 11.
What does Rule 10 require for verifiable consent?
The Data Fiduciary checks that the parent is an identifiable adult, using reliable identity and age details it already holds, details the parent provides, or a virtual token mapped to such details.
Does verifiable consent apply to persons with disability?
Yes, where they have a lawful guardian (s.9(1)). Rule 11 requires verifying that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law.
Is any Data Fiduciary exempt from verifiable consent?
Rule 12 lifts s.9(1) for the classes in Part A and the purposes in Part B of the Fourth Schedule, each only within its stated conditions. Read those conditions with counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin