India DPDPA: Article 9 – Processing of Personal Data of Children
9. Processing of Personal Data of Children
(1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.
(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.
(5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.
What Article 9 Means for Your Business
Article 9 imposes strict additional requirements before a Data Fiduciary may process personal data of a child (anyone under 18). These requirements go beyond the standard consent framework and reflect the legislature’s view that children’s data deserves heightened protection. For any business whose product or service is accessible to or directed at minors, Article 9 compliance is non-negotiable.
- Verifiable parental consent must be obtained before processing any personal data relating to a child, it is not sufficient to rely on the child’s own consent regardless of their age.
- The mechanism for verifying parental consent is prescribed under DPDP Rule 10, which requires identity and age verification of the parent or guardian through approved means.
- Behavioural monitoring of children and targeted advertising directed at children are expressly prohibited, these activities cannot be made lawful even with parental consent.
- Significant Data Fiduciaries and platforms likely to be accessed by children must design age-gating mechanisms before data collection begins.
- Certain exemptions apply under Schedule IV, for example, processing for child protection purposes or by educational institutions in connection with a child’s welfare.
- Review your product design, onboarding flows, and advertising targeting to identify any exposure to Article 9 obligations and implement technical controls accordingly.