DPDP reference

Rule 12: Exemptions for processing of personal data of child

Last checked 6 Nov 2026

s.9(1) and s.9(3) do not apply to the classes and purposes in the Fourth Schedule, within its conditions (Rule 12). Part A names clinical and mental health establishments and healthcare professionals, allied healthcare professionals, educational institutions, those caring for infants and children in a creche or day care centre, and transport for those institutions. Each has a limit, such as tracking only for educational activities or the safety of enrolled children.

Part B names purposes: functions under law in a child's interests, subsidies and similar under s.7(b), an email account, live location for the child's safety, keeping harmful content from her, and confirming a person is not a child.

Applies to
The classes and purposes named in the Fourth Schedule. Any use outside its conditions is under s.9 in full.
Starts
13 May 2027 (Rule 1(4)).
Penalty
Up to ₹200 crore (s.33, Schedule item 3).
Source
G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 12; G.S.R. 892(E), corrigenda

Questions

Can a school track its students under the DPDP Rules?

An educational institution is exempt for tracking and behavioural monitoring for its educational activities or in the interests of safety of enrolled children (Fourth Schedule, Part A, item 3).

Related

Next

Join early access

Not legal advice.