Children's data and persons with disability under the DPDP Act

The Act treats children and persons with disability who have a lawful guardian as one protected group and puts three duties on anyone processing their personal data. The Rules set out how consent is verified in each case, and list the situations where two of the three duties fall away.

Who counts as a child#

A "child" is an individual who has not completed the age of eighteen years (section 2(f)). Where the individual is a child, the Data Principal includes her parents or lawful guardian; where she is a person with disability, it includes her lawful guardian acting on her behalf (section 2(j)).

Three duties#

Before processing the personal data of a child, or of a person with disability who has a lawful guardian, a Data Fiduciary must obtain the "verifiable consent" of the parent or lawful guardian, in the prescribed manner. "Consent of the parent" includes the consent of a lawful guardian wherever applicable (section 9(1)).

Second, it must not undertake processing that is likely to cause any detrimental effect on the well-being of a child (section 9(2)). Third, it must not track or behaviourally monitor children, or direct targeted advertising at them (section 9(3)). The second duty stands on its own: the exemptions below reach only the first and third.

Verifying a parent#

Rule 10 turns "verifiable consent" into a concrete test. Appropriate technical and organisational measures must ensure the parent's verifiable consent is obtained before any of the child's personal data is processed, and due diligence must check that the individual identifying herself as the parent is an adult who is identifiable if that is needed for compliance with a law in force in India. An "adult" is an individual who has completed the age of eighteen years.

The check may run against either of two things:

reliable details of identity and age of that individual already held by the Data Fiduciary; or
details of identity and age voluntarily provided, either by the individual herself or through a virtual token mapped to those details and issued by an authorised entity.

An "authorised entity" is one entrusted by law or by the Central or a State Government with issuing identity and age details or a token mapped to them, or a person it appoints or permits, and the expression also covers details or a token made available and verified by a Digital Locker service provider (rule 10(2)).

The Rules' four illustrations turn on one distinction. If the parent is already a registered user who previously gave the platform her identity and age details, the platform checks its own records to confirm she is an identifiable adult. If she is not a registered user, it must check against details issued by an entity entrusted by law or by the Government, or a token mapped to them, which she may supply through a Digital Locker service provider. Whether the child declares the parent or the parent opens the account herself makes no difference (rule 10).

Verifying a lawful guardian#

Where an individual identifies herself as the lawful guardian of a person with disability, the Data Fiduciary must observe due diligence to verify that the guardian was appointed by a court of law, by a designated authority, or by a local level committee, under the law applicable to guardianship (rule 11(1)).

Each of those terms is defined (rule 11(2)):

Term	Meaning
Designated authority	An authority designated under section 15 of the Rights of Persons with Disabilities Act, 2016 to support persons with disabilities in exercising their legal capacity
Local level committee	A committee constituted under section 13 of the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999
Law applicable to guardianship	The Rights of Persons with Disabilities Act, 2016 and its rules, for a person with long term physical, mental, intellectual or sensory impairment who cannot take legally binding decisions despite adequate support; the National Trust Act, 1999 and its rules, for a person with autism, cerebral palsy, mental retardation, a combination of those, or severe multiple disability
Person with disability	Both groups above, in each case where the individual cannot take legally binding decisions despite adequate and appropriate support

Note the limit built in. Rule 11 reaches only individuals who cannot take legally binding decisions and who have a guardian appointed under one of those two laws. It is not a rule about disability generally.

Where the duties fall away#

The consent requirement in section 9(1) and the tracking and advertising ban in section 9(3) do not apply to processing by certain classes of Data Fiduciary, or for certain purposes, subject to conditions (section 9(4), rule 12). They are listed in the two parts of the Fourth Schedule, and each exemption runs only as far as its stated condition.

Part A: classes of Data Fiduciary#

Class	Condition
Clinical establishment, mental health establishment or healthcare professional	Restricted to providing health services to the child, to the extent necessary to protect her health
Allied healthcare professional	Restricted to supporting a treatment and referral plan that professional recommended for the child, to the extent necessary to protect her health
Educational institution	Restricted to tracking and behavioural monitoring for the institution's educational activities, or in the interests of the safety of children enrolled with it
An individual in whose care infants and children in a crèche or child day care centre are entrusted	Restricted to tracking and behavioural monitoring in the interests of the safety of children entrusted to that institution, crèche or centre
A Data Fiduciary engaged by an educational institution, crèche or child care centre to transport enrolled children	Restricted to tracking those children's location, in the interests of their safety, during travel to and from the institution, crèche or centre

Part B: purposes#

Purpose	Condition
Exercising a power, performing a function or discharging a duty in the interests of a child under a law in force in India	Restricted to what is necessary for that exercise, performance or discharge
Providing or issuing a subsidy, benefit, service, certificate, licence or permit in the interests of a child, under law, policy or public funds, under section 7(b)	Restricted to what is necessary for that provision or issuance
Creating a user account for communicating by email	Restricted to what is necessary to create the account, whose use is limited to email
Determining a child's real-time location	Restricted to that tracking, in the interest of her safety, protection or security
Ensuring that information, a service or an advertisement likely to cause a detrimental effect on a child's well-being is not accessible to her	Restricted to what is necessary to keep it inaccessible
Confirming that the Data Principal is not a child, and observing the due diligence under rule 10	Restricted to what is necessary for that confirmation or observance

The last entry closes a loop: age checking would itself involve processing a child's data, so the Rules exempt it.

The age-based exemption by notification#

The Central Government may also notify, for a particular Data Fiduciary, an age above which it is exempt from all or any of the obligations in section 9(1) and 9(3), but only if satisfied that its processing of children's data "is done in a manner that is verifiably safe" (section 9(5)). No such notification appears in the sources on this site.

Penalty#

A breach in observing the additional obligations in relation to children under section 9 carries a penalty that "may extend to two hundred crore rupees" (the Schedule), the second-highest figure in the Act.