Lesson 8.4: Exemptions for children’s data: Rule 12 and the Fourth Schedule

Module 8 · Lesson 8.4 of 6 · About 30 minutes · Rule 12 and the Fourth Schedule

Some services need to process child data. Know the narrow exceptions. This DPDPA 2023 course page explains rule 12 and the fourth schedule in plain language.

rule 12 and the fourth schedule - DPDPA 2023 course lesson banner

What you will learn about rule 12 and the fourth schedule

List the exempt classes
Understand purpose limits
Document reliance

What is exempt (rule 12 and the fourth schedule)

Certain classes, such as clinical establishments and healthcare professionals providing health services, educational institutions for educational activities and safety, childcare and transport providers for safety, may be exempt from parental consent and the tracking ban for specified purposes only. The Rules also allow processing where needed to confirm a person is not a child or to protect the child from harm.

Click each class

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Limits (rule 12 and the fourth schedule)

Point	Rule
Purpose	Only the listed purpose
Data	Only what is necessary
Duration	Only as long as needed
Records	Document why exemption applies

Worked example

A school tracks bus location for safety. It does not use that data for ads or any other purpose.

Activity (5 minutes) (rule 12 and the fourth schedule)

If you rely on an exemption, write down the class and the purpose.

Key takeaway: Exempt from consent does not mean exempt from security.

Check your understanding of rule 12 and the fourth schedule

Q1. Exemptions apply to:

Q2. A school bus tracker may:

Q3. Security duty during exemption:

← Behavioural monitoring and ad targeting Significant Data Fiduciaries and Rule 13 →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for rule 12 and the fourth schedule: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.