DPDP reference
Section 9: Processing of personal data of children
Last checked 6 Nov 2026
Before processing personal data of a child, or of a person with disability who has a lawful guardian, the Data Fiduciary obtains the verifiable consent of the parent or lawful guardian (s.9(1), as reworded by S.O. 5458(E)).
It must not process personal data in a way likely to harm a child's well being (s.9(2)). It must not track or behaviourally monitor children or target advertising at them (s.9(3)). Classes of Data Fiduciaries and purposes prescribed by the Rules are exempt from s.9(1) and s.9(3) (s.9(4)), and the Government may set a higher exemption age for processing it finds verifiably safe (s.9(5)).
- Applies to
- Every Data Fiduciary that processes personal data of anyone under eighteen, or of a person with disability who has a lawful guardian.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- Up to ₹200 crore (s.33, Schedule item 3).
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 9; G.S.R. 843(E), commencement; S.O. 5458(E), Removal of Difficulties Order, 2026
Questions
Can a business show targeted advertising to children?
No. Tracking, behavioural monitoring and targeted advertising directed at children are barred (s.9(3)), subject to the exemptions in Rule 12.
Are schools and hospitals exempt from parental consent?
Only within the conditions in the Fourth Schedule, for example a clinical establishment providing health services to the child to the extent necessary for her health (Rule 12).
Related
- Rule 10: Verifiable consent for processing of personal data of child
- Rule 11: Verifiable consent for person with disability who has lawful guardian
- Rule 12: Exemptions for processing of personal data of child
- Section 2: Definitions
Next
Not legal advice.