Rule 10
Verifiable consent for processing a child’s personal data
Requires technical measures to obtain verifiable parental consent, and due diligence that the person claiming to be a parent is an identifiable adult.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- A Data Fiduciary must adopt appropriate technical and organisational measures to ensure verifiable parental consent is obtained before processing a child’s personal data, and must observe due diligence to check that the person identifying as the parent is an identifiable adult, by reference to reliable identity and age details already held by the Data Fiduciary, or to identity and age details voluntarily provided by the individual or made available through a virtual token issued by an authorised entity, including a Digital Locker service provider.
- (2)
- Defines adult as an individual who has completed eighteen years, and defines authorised entity and Digital Locker service provider.
In practice
A self-declared date of birth is not verification, and a tick-box saying the user is a parent is not due diligence. The rule points at government-backed identity routes such as DigiLocker-issued virtual tokens, which is a real integration rather than a copy change. It also only solves s.9(1); the s.9(3) ban on tracking and targeted advertising is unaffected by any consent.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 10 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.