How to Handle Children’s Data (Rules 10 to 12)

How-to · Time: 1 to 3 days · Owner: product owner + privacy owner · Cost: low · How to Handle Children’s Data

A child is anyone under 18. Before processing a child’s data you need verifiable consent of a parent or lawful guardian, and you must not track the child, monitor behaviour or target ads at them (Section 9). The Rules explain how to verify the parent and list exemptions. This DPDPA 2023 course page explains how to handle children’s data in plain language.

how to handle children’s data - DPDPA 2023 course lesson banner
Advertisement

Decision tree: which rule applies to you? (how to handle children’s data)

How to verify the parent (Rule 10)

You must make sure the person giving consent is an identifiable adult (18 or older). Rule 10 allows three ways:

  1. Details you already hold. The parent is already a registered user whose identity and age you have reliably verified.
  2. Details the parent voluntarily provides. For example a government ID or age proof they choose to share.
  3. A virtual token. A token issued by an authorised entity, such as a digital locker provider, that confirms the parent is an adult.
Advertisement

Build the parent flow (how to handle children’s data)

  1. Ask age at sign-up. If under 18, pause the account.
  2. Ask for the parent’s contact and verify them by one of the three methods.
  3. Show the parent the notice and the specific consent.
  4. Store the verification record and consent, linked to the child’s account.
  5. Switch off tracking, behavioural monitoring and targeted ads for that account.
  6. Allow the parent to withdraw, request access or delete.

Persons with a lawful guardian (Rule 11)

If a person with a disability has a lawful guardian, check that the guardian was appointed by a court, a designated authority under the Rights of Persons with Disabilities Act, 2016, or a local-level committee under the National Trust Act, 1999. Ask for the order or certificate and keep a copy.

Exemptions (Rule 12, Fourth Schedule) (how to handle children’s data)

Who or whatCondition
Clinical, mental health and healthcare professionals; allied healthcare professionalsOnly for health services to the child
Educational institutionsTracking or behavioural monitoring for educational activities or safety
Creches and child careSafety monitoring
Transport providers for schools or crechesLocation tracking during travel
Legal duty, subsidy or benefit under law, email-only account, real-time location for safety, blocking harmful content, checking a user is not a childOnly for that purpose and only what is necessary
Penalty
Breaching children’s obligations can attract a penalty of up to ₹200 crore under the Act’s Schedule.

Related guides

Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.

Official sources for how to handle children’s data: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.