---
title: "Fourth Schedule: Exemptions from section 9(1) and 9(3) for processing children's data"
url: https://dpdp.myndsolution.com/wiki/rules/schedule-4-classes-of-data-fiduciaries-in-respect-of-whom-provisions-of/
description: "Fourth Schedule to the DPDP Rules, 2025 (Classes of Data Fiduciaries in respect of whom provisions of sub-sections (1) and (3) of section 9 shall not apply…"
kind: rules-schedule
updated: 2026-09-09
official_source: https://egazette.gov.in/WriteReadData/2025/267650.pdf
text_type: official-text-plus-interpretation
publisher: MYND Integrated Solutions
license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions.
disclaimer: Not legal advice. Official text prevails over any interpretation.
html_version: https://dpdp.myndsolution.com/wiki/rules/schedule-4-classes-of-data-fiduciaries-in-respect-of-whom-provisions-of/
---
# Fourth Schedule: Exemptions from section 9(1) and 9(3) for processing children's data

*[See rule 12]*

## Official text


### PART A


| S. No. | Class of Data Fiduciaries | Conditions |
| --- | --- | --- |
| 1. | A Data Fiduciary who is a clinical establishment, mental health establishment or healthcare professional. | Processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health. |
| 2. | A Data Fiduciary who is an allied healthcare professional. | Processing is restricted to supporting implementation of any healthcare treatment and referral plan recommended by such professional for the child, to the extent necessary for the protection of her health. |
| 3. | A Data Fiduciary who is an educational institution. | Processing is restricted to tracking and behavioural monitoring— (a) for the educational activities of such institution; or (b) in the interests of safety of children enrolled with such institution. |
| 4. | A Data Fiduciary who is an individual in whose care infants and children in a crèche or child day care centre are entrusted. | Processing is restricted to tracking and behavioural monitoring in the interests of safety of children entrusted in the care of such institution, crèche or centre. |
| 5. | A Data Fiduciary who is engaged by an educational institution, crèche or child care centre for transport of children enrolled with such institution, crèche or centre. | Processing is restricted to tracking the location of such children, in the interests of their safety, during the course of their travel to and from such institution, crèche or centre. |



### PART B


| S. No. | Purposes | Conditions |
| --- | --- | --- |
| 1. | For the exercise of any power, performance of any function or discharge of any duties in the interests of a child, under any law for the time being in force in India. | Processing is restricted to the extent necessary for such exercise, performance or discharge. |
| 2. | For providing or issuing of any subsidy, benefit, service, certificate, licence or permit, by whatever name called, under law or policy or using public funds, in the interests of a child, under clause (b) of section 7 of the Act. | Processing is restricted to the extent necessary for such provision or issuance. |
| 3. | For the creation of a user account for communicating by email. | Processing is restricted to the extent necessary for creating such user account, the use of which is limited to communication by email. |
| 4. | For the determination of real-time location of a child. | Processing is restricted to the tracking of real-time location of such child, in the interest of her safety and protection or security. |
| 5. | For ensuring that any information, service or advertisement likely to cause any detrimental effect on the well-being of a child is not accessible to her. | Processing is restricted to the extent necessary to ensure that such information, service or advertisement is not accessible to the child. |
| 6. | For confirmation by the Data Fiduciary that the Data Principal is not a child and observance of due diligence under rule 10. | Processing is restricted to the extent necessary for such confirmation or observance. |


In this Schedule, —
- **(a)** “advertisement” shall have the same meaning as is assigned to it in the Consumer Protection Act, 2019 (35 of 2019).

- **(a)** “allied healthcare professional” shall have the same meaning as is assigned to it in the clause (d) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);

- **(b)** “clinical establishment” shall have the same meaning as assigned to it in the clause (c) of section 2 of the Clinical Establishments (Registration and Regulation) Act, 2010 (23 of 2010);

- **(c)** “educational institution” shall mean and include an institution of learning that imparts education, including vocational education;

- **(d)** “healthcare professional” shall have the same meaning as is assigned to it in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);

- **(e)** “health services” shall mean the services required to be provided by a healthcare professional as referred to in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021); and

- **(f)** “mental health establishment” shall have the same meaning as is assigned to it in clause (p) of sub-section (1) of section 2 of the Mental Healthcare Act, 2017 (10 of 2017).




## Interpretation in plain English (not legal advice)

> This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation.

This Schedule lists specific types of Data Fiduciaries (persons who determine the purpose and means of processing data) and specific purposes that are exempt from the requirements of sub-sections (1) and (3) of section 9 of the Act. 

Part A covers specific classes of Data Fiduciaries. Clinical establishments, mental health establishments, and healthcare professionals are exempt when processing data to provide health services or treatment plans necessary to protect a child's health. Educational institutions, daycares, and crèches are exempt, but only for tracking or behavioral monitoring related to educational activities or the safety of the children. Transport services hired by these schools or daycares are also exempt for tracking a child's location for safety during travel.

Part B covers specific purposes that exempt any Data Fiduciary from these sub-sections. These purposes include exercising legal duties in a child's interest, providing government benefits or subsidies, and creating a user account limited to email communication. A Data Fiduciary may also track a child's real-time location for their safety and security, process data to block harmful information or advertisements, or process data to confirm that a person is not a child.

The Schedule uses definitions from other specific Indian laws for terms like "advertisement," "clinical establishment," and "healthcare professional." It defines an "educational institution" as any learning institution that imparts education, including vocational education.

### Key points

- Healthcare and mental health professionals are exempt from sub-sections (1) and (3) of section 9 when processing data to protect a child's health (Part A, Items 1-2).
- Educational institutions and daycares can track or monitor children for educational activities or safety (Part A, Items 3-4).
- Transport services hired by schools or daycares can track a child's location for safety during travel (Part A, Item 5).
- Processing is exempt if it is necessary to provide government benefits, subsidies, or services to a child (Part B, Item 2).
- Data Fiduciaries can track a child's real-time location if it is done for the child's safety, protection, or security (Part B, Item 4).
- Processing is allowed to block harmful advertisements or services, or to confirm that a user is not a child (Part B, Items 5-6).

### Common misreadings

- People might think schools can track children for any reason, but the text restricts this to educational activities or the safety of the children.
- People might assume creating any type of user account for a child is exempt, but the text limits this strictly to accounts used for communicating by email.

*Interpretation prepared 2026-09-09 from the official text only; the official text prevails.*