Definition
DPDP Act 2023 · s. 9(1); DPDP Rules 2025 · Rule 10The consent a Data Fiduciary must obtain from a parent or lawful guardian before processing a child's personal data, or that of a person with a disability who has a lawful guardian. "Verifiable" means you must check that the person consenting is an adult and is who they claim to be; Rule 10 of the DPDP Rules 2025 lets you rely on identity and age details you already hold, or on details or a virtual token issued by a body entrusted by law or by a Digital Locker service provider. Breaching s. 9 carries a penalty of up to Rs 200 crore.
The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.