s.9 · Rule 10 · Rule 11
Verifiable consent
Verifiable consent is the parental or guardian consent Section 9 requires before a child’s personal data is processed, obtained through measures that confirm the consenting person is an identifiable adult.
Rule 10 requires the Data Fiduciary to adopt technical and organisational measures to make sure consent for a child comes from a parent or guardian, and to do due diligence that the parent is an identifiable adult. The reference points are age and identity details the Fiduciary already holds, or a virtual token from a Digital Locker service.
Rule 11 applies the same idea to a person with disability who has a lawful guardian: due diligence that the guardian was appointed under the applicable guardianship law.
Questions people ask
- Does the parent need to prove identity every time?
- Rule 10 allows reliance on identity and age details the Fiduciary already holds, so a parent verified once can consent again without repeating the process.
- What if we cannot tell whether a user is a child?
- Then the design collects children’s data without verifiable consent whenever a child uses it. Age assurance at signup is the practical answer.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.