How should you handle children's data under the DPDP Act?
Get verifiable consent from a parent before you process a child's data, and never track, profile or target ads at children. The DPDP Act treats anyone under 18 as a child. Section 9 and Rule 10 set these duties, some exemptions apply under the Fourth Schedule, and breaking them can cost up to ₹200 crore.
Who is a child under the DPDP Act?
A child is anyone who has not completed 18 years of age. That is higher than in many other laws, so teenagers using apps, games, ed-tech and e-commerce services are children under the DPDP Act. For a child, the term Data Principal also includes the parent or lawful guardian.
What does Section 9 require?
Section 9 of the DPDP Act puts three extra duties on any Data Fiduciary that processes children's personal data:
| Duty | What it means in practice |
|---|---|
| Verifiable consent of a parent or lawful guardian | No processing of a child's data until a verified parent has consented |
| No processing likely to harm the child's well-being | Review features and data uses for detrimental effects on children |
| No tracking, behavioural monitoring or targeted advertising | Switch off profiling, ad targeting and behavioural tracking for child users |
How do you verify parental consent under Rule 10?
Under Rule 10 of the DPDP Rules 2025, you must take due care to check that the person giving consent as the parent is an identifiable adult. You can rely on:
- reliable identity and age details of the parent that you already hold;
- identity and age details the parent provides voluntarily;
- a virtual token mapped to such details, issued by an entity entrusted with that role by law or by the government, including one made available through a DigiLocker service.
The same idea applies to a person with a disability who cannot take legally binding decisions: consent comes from their lawful guardian, verified under Rule 11.
Are any organisations exempt?
Yes, some exemptions apply. The Fourth Schedule to the Rules lists certain classes of Data Fiduciaries, such as educational institutions, and certain purposes for which some Section 9 duties do not apply, within set limits. Check the Fourth Schedule for the exact scope before relying on an exemption, and record why it applies to each processing activity.
What should you do now?
- Find out whether children use your service, and where their data sits in your systems and exports.
- Add an age check at sign-up, and route under-18 users to a parental consent flow.
- Verify the parent using one of the Rule 10 methods, and keep a record of each consent.
- Turn off tracking, behavioural monitoring and targeted advertising for children.
- Record any Fourth Schedule exemption you rely on and why.
These duties apply from 13 May 2027. Our DPDP compliance checklist places them alongside the other steps.
What is the penalty for getting it wrong?
Breaching the additional obligations for children's data can cost up to ₹200 crore, one of the highest amounts in the Schedule to the Act. See DPDP Act penalties for the full list.
How GRC Flow helps
GRC Flow's personal data discovery scans a CSV or JSON export and flags dates of birth under 18, so you can see where children's data sits. A person confirms each finding before it joins the data inventory, and consent records are kept in the DPDP registers.
Frequently asked questions
What is the age of a child under the DPDP Act?
Under 18. The DPDP Act defines a child as an individual who has not completed eighteen years of age.
What is verifiable parental consent under the DPDP Rules?
Consent from a parent that the Data Fiduciary has checked comes from an identifiable adult. Rule 10 allows this check using reliable identity and age details the Data Fiduciary already holds, details the parent provides, or a virtual token linked to such details issued by an authorised entity, including through DigiLocker.
Can you show targeted ads to children under the DPDP Act?
No. Section 9 prohibits tracking, behavioural monitoring of children and targeted advertising directed at children, subject only to the exemptions the government notifies.
Are schools exempt from parental consent under the DPDP Rules?
Some exemptions apply to certain classes of Data Fiduciaries, including educational institutions, and to certain purposes, within the limits the Rules set. Check the Fourth Schedule to the DPDP Rules 2025 for the exact scope before relying on one.
What is the penalty for misusing children's data under the DPDP Act?
Up to ₹200 crore for breaching the additional obligations for children's data under Section 9.
Sources
- PIB: Digital Personal Data Protection Rules, 2025
- SCC Online: MeitY notifies the DPDP Rules 2025
- AMLEGALS: Penalties under the DPDP Act, 2023
This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.