Verifiable consent for processing of personal data of child
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 200 croreAct, Schedule, item 3
- Binds
- Data Fiduciaries processing children's data
In plain English
Before processing a child's personal data (anyone under 18), a Data Fiduciary must obtain verifiable consent from the parent and check, with due diligence, that the person claiming to be the parent is an identifiable adult. The check uses reliable identity and age details the company already holds, or details the parent provides voluntarily, directly or through a virtual token issued by an authorised entity such as a Digital Locker service provider (DigiLocker).
The four illustrations cover the combinations: the child declares a parent who is or is not already a registered user, or the parent opens the account. In every case the company confirms it holds, or is shown, reliable identity and age details of an adult.
What you must do
Design an age and parent-verification flow that works for existing users and for parents who are not users, with a DigiLocker or token-based route.
Keep a record of the verifiable consent and the basis on which you treated the consenting person as an identifiable adult.
Pair this with s. 9(2) and (3) of the Act: no detrimental processing, no tracking, behavioural monitoring or targeted advertising directed at children, unless a Fourth Schedule exemption applies.
Gazette text · Rule 10A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India, by reference to—
- (1)A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India, by reference to—
- (a)reliable details of identity and age of the individual available with the Data Fiduciary; or
- (b)details of identity and age, voluntarily provided —
- (i)by the individual; or
- (ii)through a virtual token mapped to such details, which is issued by an authorised entity.
- (i)
- (a)
- (2)In this rule, the expression—
- (a)“adult” shall mean an individual who has completed the age of eighteen years;
- (b)“authorised entity" shall mean —
- (i)an entity entrusted by law or by the Central Government or by the State Government with the issuance of details of the identity and age or a virtual token mapped to such details; or
- (ii)a person appointed or permitted by the entity specified under clause (i), for such issuance, and also includes details of identity and age or token made available and verified by a Digital Locker Service Provider;
- (i)
- (c)“Digital Locker service provider” shall mean such intermediary, including a body corporate or an agency of the appropriate Government, as may be notified by the Central Government, in accordance with the rules made in this regard under the Information Technology Act, 2000 (21 of 2000);
- Illustration. C is a child, P is a parent, and DF is a Data Fiduciary. A user account of C is sought to be created on the online platform of DF, by processing the personal data of C. Case 1: C informs DF that she is a child and declares P as her parent. DF shall enable P to identify herself through its website, app or other appropriate means. P identifies herself as the parent and informs DF that she is a registered user on DF’s platform and has previously made available her identity and age details to DF. Before processing C’s personal data for the creation of her user account, DF shall check to confirm that it holds reliable identity and age details of P and that P is an identifiable adult. Case 2: C informs DF that she is a child and declares P as her parent. DF shall enable P to identify herself through its website, app or other appropriate means. P identifies herself as the parent and informs DF that she herself is not a registered user on DF’s platform. Before processing C’s personal data for the creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the Government with maintenance of the said details or to a virtual token mapped to the identity and age, check that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital Locker service provider. Case 3: P is opening an account for C and identifies herself as C’s parent and informs DF that she is a registered user on DF’s platform and has previously made available her identity and age details to DF. Before processing C’s personal data for the creation of her user account, DF shall check to confirm that it holds reliable identity and age details of P and that P is an identifiable adult. Case 4: P is opening an account for C and identifies herself as C’s parent and informs DF that she herself is not a registered user on DF’s platform. Before processing C’s personal data for the creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the Government with maintenance of the said details or to a virtual token mapped to the identity and age, check that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital Locker service provider.
- (a)
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log