Rule 10: Verifiable consent for processing of personal data of child

A Data Fiduciary (any person who determines the purpose and means of processing personal data) must obtain verifiable consent from a parent before processing any personal data of a child. To do this, the Data Fiduciary must put in place appropriate technical and organizational measures. The Data Fiduciary must also use due diligence to confirm that the person claiming to be the parent is actually an adult, meaning someone who has completed eighteen years of age. This person must be identifiable if required for compliance with any Indian law. To verify the parent's age and identity, the Data Fiduciary can rely on reliable details it already has on file. If the Data Fiduciary does not already have these details, the parent can voluntarily provide them. The parent can provide these details directly or through a virtual token issued by an authorized entity, such as a government-entrusted issuer or a Digital Locker service provider.

Key points

• A Data Fiduciary must use technical and organizational measures to get verifiable consent from a parent before processing a child's personal data. (1)
• The Data Fiduciary must check that the person identifying as the parent is an adult who is at least eighteen years old. (1, 2(a))
• Verification can be done using reliable identity and age details already held by the Data Fiduciary. (1(a))
• Verification can also be done using details voluntarily provided by the individual, including through a virtual token from an authorized entity like a Digital Locker service provider. (1(b), 2(b))

Common misreadings

• Parents are not forced to use a government ID or Digital Locker if the Data Fiduciary already has reliable identity and age details on file.
• The rule requires verifying that the parent is an adult, not just obtaining a simple declaration without any checks.