Section 9
Verifiable parental consent for DPDP
Under DPDP a child is anyone under 18. Before you process a child's personal data you need a parent's verifiable consent and a way to check the parent is an adult.
Short answer
Under s.9(1) you need the verifiable consent of a parent before processing a child's personal data, and a child is anyone who has not completed eighteen years of age. Rule 10 requires you to check that the person consenting is an identifiable adult, using reliable identity and age details you already hold, details the parent provides, or a virtual token mapped to such details. You must not undertake processing likely to cause a detrimental effect on a child's well-being, or tracking, behavioural monitoring or targeted advertising directed at children (s.9(2), s.9(3)), subject to the Rule 12 exemptions.
What s.9 and Rule 10 require
- Verifiable consent of the parent before processing a child's personal data (s.9(1))
- Verifiable consent of the lawful guardian for a person with disability who has one (s.9(1), Rule 11)
- No processing likely to cause a detrimental effect on a child's well-being (s.9(2))
- No tracking, behavioural monitoring or targeted advertising directed at children (s.9(3))
- A check that the parent is an identifiable adult (Rule 10)
- Exemptions only for the classes and purposes in the Fourth Schedule, within their conditions (s.9(4), s.9(5), Rule 12)
The section 9 page explains each duty in more detail.
Steps to implement
- 01Find where children's data enters
List the products, forms and sign-ups where under-18s may give personal data, including school, tutoring and gaming features.
- 02Ask for age first
Ask for date of birth or age before collecting anything else, and route under-18s to the parental flow.
- 03Request the parent's consent
Send the parent a notice that itemises the child's data and purposes (Rule 3) and asks for consent.
- 04Verify the parent is an adult
Use one of the Rule 10 routes in the next section, and record which one you used.
- 05Record the decision
Keep who consented, for which child, for which purposes, the verification route and the time.
- 06Switch off what s.9(3) bars
Disable tracking, behavioural monitoring and targeted advertising for child accounts, including in third-party scripts and libraries.
- 07Support withdrawal
Let the parent withdraw as easily as they consented, and stop processing within a reasonable time (s.6(4), s.6(6)).
Choosing a verification route
| Rule 10 route | Example | Watch for |
|---|---|---|
| Reliable identity and age details you already hold | The parent already has a verified adult account with you (sample: an Example Finance customer) | Use only details that are reliable and already verified |
| Details the parent provides | The parent enters identity and age details, which you check | Collect only what you need to confirm adulthood; do not keep copies of ID documents longer than necessary |
| A virtual token mapped to such details | A token mapped to reliable identity and age details, for example through a Digital Locker service provider | Know what the token confirms, and keep the token reference rather than the underlying details |
Over-collection is the main risk. A parental check should show the parent is an adult, not build a file on them; s.6 limits processing to what the purpose needs.
Persons with disability and lawful guardians
Section 9(1) also covers a person with disability who has a lawful guardian. Before you accept consent from the guardian, Rule 11 requires you to verify that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law. Keep the appointment reference with the consent record.
Rule 12 exemptions, with edtech and gaming examples
Rule 12 disapplies s.9(1) and s.9(3) for the classes in Part A of the Fourth Schedule, such as clinical establishments, allied healthcare, educational institutions, crèches and transport for school children. It does the same for purposes in Part B, such as age verification, email-only accounts and real-time location for safety, each only within the conditions stated there.
- Edtech: an educational institution may fall within Part A for some processing, within the stated conditions. A commercial learning app should not assume the same; check with counsel.
- Gaming: a game used by under-18s needs the parental flow and must avoid tracking and targeted advertising directed at children, unless a Part B purpose applies within its conditions.
Read the Fourth Schedule conditions with counsel before relying on any exemption, and record why it applies.
Children's data checklist
- Age asked before any other data
- Parental notice meets Rule 3
- Rule 10 verification route chosen and recorded
- Parent identity data kept to the minimum
- Tracking and targeted advertising off for child accounts (s.9(3))
- Guardian appointment verified for persons with disability (Rule 11)
- Any Rule 12 reliance documented with counsel's view
- Withdrawal path open to parents
How TruePrivacy helps
Children's data in TruePrivacy runs a parental (guardian) consent flow: you raise a request, the guardian is notified by email and verifies with a code, and the decision is recorded with a timeline and evidence. Consent is revocable, and a request expires if the guardian does not decide in time. The flow uses 18 as the DPDP minor age.
Decide and record your Rule 10 adult check alongside the flow. Purposes and withdrawals sit in consent management. Related tool: the consent checklist.
What age is a child under DPDP?
Anyone who has not completed eighteen years of age (s.2).
How do we verify a parent under Rule 10?
Check that the person is an identifiable adult using reliable identity and age details you already hold, details the parent provides, or a virtual token mapped to such details, for example through a Digital Locker service provider.
Can we show targeted ads to teenagers?
Not to anyone under 18. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, unless a Rule 12 exemption applies within its conditions.
Are schools exempt?
Educational institutions are among the classes in Part A of the Fourth Schedule, but only within the conditions stated there (Rule 12). Read them with counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin