Fourth Schedule: Children's data: who is exempt from parental consent and the tracking ban, and on what conditions
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 50 croreAct, Schedule, item 7
- Binds
- Every Data Fiduciary
In plain English
Part A exempts five classes of Data Fiduciary from s. 9(1) (verifiable parental consent) and s. 9(3) (no tracking, behavioural monitoring or targeted advertising at children), each on a condition: clinical establishments, mental health establishments and healthcare professionals, for health services to the child; allied healthcare professionals, for a treatment and referral plan; educational institutions, for tracking and behavioural monitoring in the course of education or for the safety of enrolled children; creches and day-care carers, for the safety of children in their care; and transport providers engaged by schools or creches, for tracking children's location during travel.
Part B exempts six purposes: exercising powers or duties in a child's interests under law; providing a subsidy, benefit, service, certificate, licence or permit for a child under s. 7(b); creating an email-only user account; determining a child's real-time location for safety; keeping information, services or advertisements likely to harm a child's well-being away from them; and confirming that a user is not a child and performing the due diligence under Rule 10. Each is limited to what that purpose needs.
What you must do
Match your processing to a specific Part A or Part B entry and its condition before treating s. 9(1) or 9(3) as not applying.
Remember s. 9(2), the ban on processing likely to cause a detrimental effect on a child's well-being, is not lifted by this Schedule.
Note
Corrigenda G.S.R. 892(E) of 10 Dec 2025 corrected typographical errors in the notification, including the lettering of the clauses in this Schedule's Note (the first two are both printed as "(a)"). The text here is the notification as first published; the corrigenda are listed in the sources.
Gazette text · Fourth Schedule[See rule 12]
- [See rule 12]
- PART A
- Classes of Data Fiduciaries in respect of whom provisions of sub-sections (1) and (3) of section 9 shall not apply
| Sl. No. | Entry | Conditions |
|---|---|---|
| 1. | A Data Fiduciary who is a clinical establishment, mental health establishment or healthcare professional. | Processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health. |
| 2. | A Data Fiduciary who is an allied healthcare professional. | Processing is restricted to supporting implementation of any healthcare treatment and referral plan recommended by such professional for the child, to the extent necessary for the protection of her health. |
| 3. | A Data Fiduciary who is an educational institution. | Processing is restricted to tracking and behavioural monitoring—
|
| 4. | A Data Fiduciary who is an individual in whose care infants and children in a crèche or child day care centre are entrusted. | Processing is restricted to tracking and behavioural monitoring in the interests of safety of children entrusted in the care of such institution, crèche or centre. |
| 5. | A Data Fiduciary who is engaged by an educational institution, crèche or child care centre for transport of children enrolled with such institution, crèche or centre. | Processing is restricted to tracking the location of such children, in the interests of their safety, during the course of their travel to and from such institution, crèche or centre. |
- PART B
- Purposes for which provisions of sub-sections (1) and (3) of section 9 shall not apply
| Sl. No. | Entry | Conditions |
|---|---|---|
| 1. | For the exercise of any power, performance of any function or discharge of any duties in the interests of a child, under any law for the time being in force in India. | Processing is restricted to the extent necessary for such exercise, performance or discharge. |
| 2. | For providing or issuing of any subsidy, benefit, service, certificate, licence or permit, by whatever name called, under law or policy or using public funds, in the interests of a child, under clause (b) of section 7 of the Act. | Processing is restricted to the extent necessary for such provision or issuance. |
| 3. | For the creation of a user account for communicating by email. | Processing is restricted to the extent necessary for creating such user account, the use of which is limited to communication by email. |
| 4. | For the determination of real-time location of a child. | Processing is restricted to the tracking of real-time location of such child, in the interest of her safety and protection or security. |
| 5. | For ensuring that any information, service or advertisement likely to cause any detrimental effect on the well-being of a child is not accessible to her. | Processing is restricted to the extent necessary to ensure that such information, service or advertisement is not accessible to the child. |
| 6. | For confirmation by the Data Fiduciary that the Data Principal is not a child and such observance of due diligence under rule 10. | Processing is restricted to the extent necessary for such confirmation or observance. |
- Note: In this Schedule, —
- (a)“advertisement” shall have the same meaning as is assigned to it in the Consumer Protection Act, 2019 (35 of 2019).
- (a)“allied healthcare professional” shall have the same meaning as is assigned to it in the clause (d) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);
- (b)“clinical establishment” shall have the same meaning as assigned to it in the clause (c) of section 2 of the Clinical Establishments (Registration and Regulation) Act, 2010 (23 of 2010);
- (c)“educational institution” shall mean and include an institution of learning that imparts education, including vocational education;
- (d)“healthcare professional” shall have the same meaning as is assigned to it in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);
- (e)“health services” shall mean the services required to be provided by a healthcare professional as referred to in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021); and
- (f)“mental health establishment” shall have the same meaning as is assigned to it in clause (p) of sub-section (1) of section 2 of the Mental Healthcare Act, 2017 (10 of 2017).
- (a)
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Sources: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy); Corrigenda G.S.R. 892(E), 10 Dec 2025 (MeitY copy) · Change log