Children's data under DPDP: verifiable parental consent explained

Sehmat team · 10 September 2026

Under the DPDP Act, a child is anyone under 18. Before you process a child’s personal data, you must get verifiable consent from a parent or lawful guardian (s.9(1)). From 13 May 2027, Rule 10 says you must check that the person giving consent is an identifiable adult. You can use reliable details you already hold, details the person gives, or a virtual token from an authorised entity such as a DigiLocker service provider.

The Act also bans tracking, behavioural monitoring and targeted advertising aimed at children (s.9(3)). Some organisations and purposes are exempt from parts of these rules (Rule 12, Fourth Schedule).

Key points

A child is an individual who has not completed 18 years (s.2(f)).
Get verifiable consent from the parent or lawful guardian before processing a child’s data (s.9(1)).
Do not process a child’s data in a way likely to harm the child’s well-being (s.9(2)).
No tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)).
Rule 10 sets out how to check that the parent is an identifiable adult. Rule 11 covers guardians of persons with disability.
The Fourth Schedule lists exemptions from s.9(1) and s.9(3), each with conditions.
The Act’s Schedule allows a penalty of up to ₹200 crore for breaching the duties in s.9.

What does “verifiable” mean under Rule 10?

Rule 10(1) asks you to adopt “appropriate technical and organisational measures” so that a parent’s verifiable consent is obtained before you process a child’s data. You must use due diligence to check that the person who says they are the parent is an adult who is identifiable if the law requires it. You check by reference to one of these:

(a) reliable identity and age details that you already hold about that person; or
(b) identity and age details given voluntarily:
- (i) by the person, or
- (ii) through a virtual token mapped to those details, issued by an authorised entity.

An “authorised entity” is a body entrusted by law or by the Central or a State Government to issue identity and age details or tokens. It also covers someone that body appoints or permits. It includes details or tokens made available and verified by a DigiLocker service provider (Rule 10(2)(b)).

The four cases in the Rules

Rule 10 gives four examples:

The child signs up and names a parent who already has an account with you. You check that you hold reliable identity and age details for the parent.
The child signs up and names a parent who has no account. You check the parent’s identity and age against government-issued details or a virtual token. The parent may use DigiLocker.
The parent opens the account for the child and already has an account. You check the details you hold.
The parent opens the account and has no account. You check through government-issued details or a token, for example via DigiLocker.

Where does DigiLocker fit?

DigiLocker lets a person share verified details from their own locker. For Rule 10, the useful part is a token that confirms the parent is an adult without you collecting and storing copies of identity documents. Keep only what you need to show the check was done. That fits the Act’s rule to limit data to what is necessary (s.6(1)) and reduces your security exposure (Rule 6).

DigiLocker is one option, not the only one. Rule 10(1)(a) and (b)(i) allow other ways, if they are reliable.

Which organisations and purposes are exempt?

Rule 12 and the Fourth Schedule remove the s.9(1) consent duty and the s.9(3) tracking ban in some cases. Each exemption applies only within its stated conditions.

Part A, classes of Data Fiduciaries:

clinical and mental health establishments and healthcare professionals, for health services to the child;
allied healthcare professionals, for the child’s treatment and referral plan;
educational institutions, for tracking and monitoring for educational activities or the safety of enrolled children;
crèches and child day care centres, for children’s safety;
transport providers engaged by schools, crèches or care centres, for location tracking during travel.

Part B, purposes:

legal functions in the child’s interest;
subsidies, benefits, services, certificates, licences or permits for the child under s.7(b);
creating an email-only user account;
real-time location tracking for the child’s safety;
keeping harmful information, services or advertisements away from the child;
confirming that a user is not a child, as part of Rule 10 due diligence.

These are narrow. A school is exempt for educational tracking, not for marketing to students.

What about persons with disability?

Section 9(1) also covers a person with disability who has a lawful guardian. Under Rule 11, you must use due diligence to verify that the guardian was appointed by a court, by a designated authority under the Rights of Persons with Disabilities Act, 2016, or by a local level committee under the National Trust Act, 1999. In practice, ask for the appointment order and record that you checked it.

A practical approach

Ask for date of birth, or an 18+ declaration, only where you need it.
Route anyone under 18 to a parent or guardian consent flow.
Verify the parent with details you hold, a document check, or a DigiLocker token.
Keep a record of the check, not copies of documents you do not need.
Remove tracking and targeted advertising from any experience aimed at children, unless an exemption clearly applies.
When a child turns 18, ask them for their own consent.

How Sehmat helps

Parent or guardian consent can use DigiLocker verification. By default only an age result and hashes are kept; an organisation can choose to keep identity details too. Document review is also available.
People confirm they are 18 or over with their own self-declaration tick.
When a child reaches 18, Sehmat asks them for consent in their own right.
Each consent is stored with the exact notice version and language shown, as evidence of what the parent saw.

Sources

This article is general information, not legal advice.