s.2 · s.9 · Rule 10 · Rule 12 · Sch. IV
Child
A child under the DPDP Act is any individual who has not completed eighteen years of age, and processing a child’s personal data requires verifiable consent from a parent or lawful guardian.
Eighteen, not thirteen and not sixteen. A product built to the American or European threshold is already outside the Indian one. Section 9 requires verifiable parental consent before processing, and prohibits tracking, behavioural monitoring and targeted advertising directed at children.
Rule 10 sets how verifiable consent is obtained: technical and organisational measures to check that the person giving consent is an identifiable adult, using identity details the Fiduciary already holds or a Digital Locker token. The Fourth Schedule and Rule 12 carve out limited classes and purposes, such as schools and health services, from parts of Section 9.
The Schedule assigns the Rs 200 crore band to failures of the child provisions.
Questions people ask
- We do not target children. Does Section 9 apply to us?
- It applies whenever you process a child’s data. A site that lets anyone sign up without checking age is processing children’s data whenever a child signs up.
- Is a checkbox saying "I am over 18" enough?
- No. Rule 10 requires due diligence that the person giving consent is an identifiable adult, not a self-declaration.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.