Section 9 · Rules 10–12
Children's data and guardian consent under DPDP
Under the DPDP Act a child is anyone under 18, and their personal data needs a parent's verifiable consent. TruePrivacy records the guardian's decision with a timeline and evidence.
Sample workspace
Guardian consent DP-••7730
- LearnerUnder 18
- Guardianr••••@example.com
- Progress reports to schoolGiven
- Basiss.9(1)
Timeline
- Guardian notified by email
- Guardian verified with code
- Consent given; revocable at any time
Short answer
Under s.9(1) of the DPDP Act, processing a child's personal data (a child is under 18) needs the verifiable consent of a parent or lawful guardian, and Rule 10 asks you to check that the parent is an identifiable adult. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, and Rule 12 lifts s.9(1) and s.9(3) for some classes and purposes, within stated conditions. TruePrivacy's guardian consent flow notifies the guardian by email, verifies them with a code and records the decision with a timeline and evidence.
What the guardian consent flow does
Duties for children's data begin with the core obligations on 13 May 2027. Use the time to design the guardian flow and the checks behind it.
Start a consent request for a child's account. The guardian is notified by email.
The guardian verifies with a code before deciding.
The decision is recorded with a timeline and evidence, for your proof of consent under s.6(10).
The guardian can revoke consent later.
A request expires if the guardian does not decide in time.
How verifiable parental consent runs
- 01Identify a child user
Decide how your product learns that a user is under 18. The flow starts when you send a guardian request.
- 02Notify the guardian
TruePrivacy emails the guardian with the request.
- 03Verify and decide
The guardian verifies with a code and gives or refuses consent. Rule 10 also asks you to check the parent is an identifiable adult, using reliable identity and age details you already hold, details the parent provides, or a virtual token mapped to such details.
- 04Keep the record
The decision, timeline and evidence stay on record, and the guardian can revoke consent later. The verifiable consent guide covers the Rule 10 options in more detail.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Verifiable consent of a parent or lawful guardian | s.9(1) | Guardian consent flow: email notice, code verification and a recorded decision |
| Check that the parent is an identifiable adult | Rule 10 | Records the code verification, decision and evidence; you choose which identity and age details to rely on |
| Withdraw consent as easily as it was given | s.6(4) | Guardian consent is revocable |
| Prove notice and consent | s.6(10) | A timeline and evidence for each decision |
What stays your decision
An email code shows the guardian controls that address. Rule 10 asks for more: that the parent is an identifiable adult, checked with reliable identity and age details. Choose those checks with counsel.
- Rule 11: before accepting consent from the lawful guardian of a person with disability, verify the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law. See Rule 11.
- Rule 12: exemptions for classes such as clinical establishments, educational institutions and crèches, and purposes such as age verification, apply only within the conditions in the Fourth Schedule. Read Rule 12 with counsel.
- Section 9(2) and 9(3): no processing likely to harm a child's well-being, and no tracking, behavioural monitoring or targeted advertising directed at children. These are product decisions for your team.
Works with
Who is a child under the DPDP Act?
An individual who has not completed eighteen years of age. Processing their personal data needs the verifiable consent of a parent or lawful guardian (s.9(1)).
How does TruePrivacy verify a parent?
The guardian is notified by email and verifies with a code, and the decision is recorded with a timeline and evidence. Rule 10 also asks you to check the parent is an identifiable adult; choose those checks with counsel.
Does Rule 12 exempt educational institutions?
Rule 12 lifts s.9(1) and s.9(3) for classes in Part A of the Fourth Schedule, such as educational institutions, and for purposes in Part B, only within the conditions stated there. Read the conditions with counsel before relying on them.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin