DPDP reference
Rule 10: Verifiable consent for processing of personal data of child
Last checked 6 Nov 2026
The Data Fiduciary uses appropriate measures to obtain verifiable consent of the parent before processing a child's personal data, and checks with due diligence that the person is an identifiable adult (Rule 10(1)). It may rely on reliable identity and age details it already holds, or on details given voluntarily by the person or through a virtual token issued by an authorised entity, including through a Digital Locker service provider.
An adult is an individual who has completed eighteen years (Rule 10(2)(a)). The Rule's four cases cover a child who declares a parent and a parent who opens the account, each with a parent who is or is not already a registered user.
- Applies to
- Every Data Fiduciary processing a child's personal data, unless Rule 12 applies.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹200 crore (s.33, Schedule item 3).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 10; G.S.R. 892(E), corrigenda
Questions
Can DigiLocker be used for parental consent?
Rule 10 allows a parent to make identity and age details available through a Digital Locker service provider. It does not make that the only route.
Related
- Section 9: Processing of personal data of children
- Rule 11: Verifiable consent for person with disability who has lawful guardian
- Rule 12: Exemptions for processing of personal data of child
Next
Not legal advice.