Children's data under the DPDP framework

The provisions this tool rests on

The provisions below are the sources for the legal statements on this page. Each links to the official document it was verified against, and to the provision on this site wherever this site publishes that provision. The label says whether the site is reporting a requirement, explaining it, reading it, recommending something, or pointing at a text it does not restate.

• DPDP Act 2023, s. 2(f)

  Official requirement · Verified 17 August 2026

  In force since 13 November 2025

  “child” means an individual who has not completed the age of eighteen years

  Section 2 on this site Official source ↗

• DPDP Act 2023, s. 9, (2)

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.

  Section 9 on this site Official source ↗

• DPDP Act 2023, s. 9, (3)

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

  Section 9 on this site Official source ↗

• DPDP Rules 2025, r. 10

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India, by reference to — (a) reliable details of identity and age of the individual available with the Data Fiduciary; or (b) details of identity and age, voluntarily provided — (i) by the individual; or (ii) through a virtual token mapped to such details, which is issued by an authorised entity.

  Rule 10 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Rules 2025, r. 11

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) A Data Fiduciary, while obtaining verifiable consent from an individual identifying herself as the lawful guardian of a person with disability, shall observe due diligence to verify that such guardian is appointed by a court of law, or by a designated authority or by a local level committee, under the law applicable to guardianship.

  Rule 11 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Rules 2025, r. 12

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) The provisions of sub-sections (1) and (3) of section 9 of the Act shall not be applicable to processing of personal data of a child by such class of Data Fiduciaries as are specified in Part A of Fourth Schedule, subject to such conditions as are specified in the said Part. (2) The provisions of sub-sections (1) and (3) of section 9 of the Act shall not be applicable to processing of personal data of a child for such purposes as are specified in Part B of Fourth Schedule, subject to such conditions as are specified in the said Part.

  Rule 12 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Act 2023, s. 9, (4) and (5)

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed. (5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.

  Section 9 on this site Official source ↗