Processing of personal data of children
- Status
- Upcoming
- Applies from
- 13 May 2027G.S.R. 843(E)
- Penalty
- Up to Rs 200 croreSchedule, item 3
- Binds
- Data Fiduciaries processing children's data
In plain English
Before processing the personal data of a child (anyone under 18) or of a person with a disability who has a lawful guardian, the Data Fiduciary must get verifiable consent from the parent or guardian. It must not process children's data in a way likely to harm a child, and must not track children, monitor their behaviour or target advertising at them. The Central Government can exempt classes of fiduciaries or purposes, and can lower the age for fiduciaries it finds process children's data safely. Rule 10 sets how parental consent is verified and Rule 11 lists the exemptions.
What you must do
Obtain verifiable parental or guardian consent before processing a child's data, using the identity and age checks Rule 10 allows.
Switch off tracking, behavioural monitoring and targeted advertising for users under 18.
Check whether your sector or purpose is exempted under Rule 12 and the Fourth Schedule before relying on an exemption.
Gazette text · s. 9The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
- (1)The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
- Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.
- (2)A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
- (3)A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
- (4)The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.
- (5)The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.
Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)
Rules and tools that apply
Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, s. 9; DPDP Rules 2025, Rules 10 to 12 · Change log