Children, parents and nominees
Extra protection for under-18s, and who can act for you
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Under 18 is a child under this law
For this law, everyone under eighteen is a child. A child cannot give consent alone. A parent or lawful guardian must give verifiable consent.
The definition is in s.2(f) and the consent duty in s.9(1). There is no separate, lighter rule for teenagers. The Central Government may notify a lower age for a particular organisation if it is satisfied that its processing of children's data is verifiably safe (s.9(5)); the Act and Rules themselves name no such organisation.
Parents count too
The law treats parents and lawful guardians as part of the child's side. You can use the rights in this law on your child's behalf.
Section 2(j)(i) says that where the individual is a child, 'Data Principal' includes the parents or lawful guardian. The Act does not say what happens if two parents disagree, or how consent given by a parent is treated once the child turns eighteen.
How parental consent works
When a child signs up, the platform must let a parent identify themselves and check that the parent is an adult. Only after the parent consents may it process the child's data.
These steps follow the Illustration to Rule 10, which also covers a parent opening the account for the child. Rule 10(1) requires due diligence that the person claiming to be the parent is an adult who is identifiable if the law requires. The Rules do not spell out how a platform should confirm the parent and child relationship, or how it should spot a child who claims to be an adult.
Two ways a parent can prove age
As a parent you may be asked to show you are an adult. You can give identity and age details, or a virtual token issued by an authorised body, such as through a Digital Locker service.
Rule 10(1) allows the check by reference to reliable details the platform already has, or details you provide voluntarily, or a virtual token mapped to those details. The token must come from an entity entrusted by law or by the Government, and may be made available through a Digital Locker service provider notified by the Central Government (Rule 10(2)). The Rules do not name any particular identity document or app.
What platforms may not do to children
Organisations must not track children, monitor their behaviour, or aim targeted advertising at them. They must not process data in ways likely to harm a child's well-being.
Section 9(2) bars processing likely to cause any detrimental effect on the well-being of a child. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. The Act does not define these terms further. Breach of the duties on children's data can bring a penalty of up to ₹200 crore (Schedule, item 3).
Where the child rules are relaxed
Some organisations are exempt from parental consent and the tracking ban, within strict limits. Examples are clinics, schools, crèches and school transport.
Rule 12 and the Fourth Schedule lift s.9(1) and s.9(3) only for the limited processing described. The Schedule also covers functions under law in the interests of a child, government benefits for a child, creating an account used only for email, and checking that a user is not a child. The ban on processing likely to harm a child's well-being (s.9(2)) has no exemption. Other laws and a school's own policies may still require a parent's permission.
Guardians of persons with disability
Where a person with disability has a lawful guardian, the guardian gives consent. The organisation must verify that a court, a designated authority or a local level committee appointed the guardian.
Rule 11 applies to a person who, despite adequate and appropriate support, is unable to take legally binding decisions, and who has a lawful guardian. It does not apply to every person with a disability. The local level committee is one constituted under the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999. For such a person, 'Data Principal' includes the lawful guardian acting on her behalf (s.2(j)(ii)).
Nominating someone to act for you
You can nominate one or more people to use your data rights if you die or become unable to act. You do this with each organisation, using the method it provides.
The right is in s.14, and 'incapacity' is defined in s.14(2). Rule 14(4) says you nominate in accordance with the organisation's terms of service and applicable law, using the means it requires. The Act and Rules do not create one central register, so you nominate with each organisation separately. The nominee exercises your rights under this Act, such as access, correction, erasure and grievance; the Act does not say the nominee inherits the account or its contents.
In one line
Next: what happens when your data is breached, and how to complain.