Children and vulnerable people

Under 18 is a child under the Act

Anyone who has not completed 18 years is a child under the Act. That includes the teenagers in your youth groups, hostels and skilling programmes.

s.2(f) defines a child as an individual who has not completed the age of eighteen years, and s.2(j) says that for a child the Data Principal includes the parents or lawful guardian. s.9(5) lets the Government notify a lower age for a particular fiduciary whose processing of children's data is verifiably safe. Unless such a notification applies to you, treat 18 as the line.

Three rules for children's data

Three rules apply to children's data. Get a parent's verifiable consent first, do nothing likely to harm the child, and do not track, monitor or target children.

The child's own agreement is not enough under the Act, though asking the child as well is good practice. The rule against processing likely to cause a detrimental effect on a child's well-being (s.9(2)) has no exemption, and breach of the s.9 duties carries a penalty of up to ₹200 crore (Schedule, item 3). The Act does not define 'tracking' or 'behavioural monitoring', so it is not settled how they apply to attendance apps or case-management notes. Take advice if your programme follows individual children over time.

Getting a parent's verifiable consent

Rule 10 asks you to take due care that the person consenting for a child is an identifiable adult. You can use reliable details you already hold, or identity and age details they give voluntarily.

Rule 10 requires due diligence that the person identifying herself as the parent is an adult who is identifiable if required. It accepts reliable identity and age details already with you, details the person voluntarily provides, or a virtual token from an authorised entity, including through a Digital Locker service provider. The Rule's illustrations are all about online accounts; it does not describe a field process or say how to confirm the parent and child relationship. Record what you checked and why you found it reliable.

Limited relief under the Fourth Schedule

Clinics, schools, crèches and their transport get relief from parental consent and the tracking ban, but only for the purpose listed against each. The no-harm rule always applies.

Part A covers clinical and mental health establishments and healthcare professionals, for health services needed to protect the child's health; educational institutions, for tracking and monitoring for educational activities or enrolled children's safety; an individual caring for children in a crèche or day care centre; and transport engaged by these institutions. 'Educational institution' means an institution of learning that imparts education, including vocational education, and the health terms are defined by other Acts. Whether an informal learning centre, bridge course or community health programme fits is not settled by the text, so take advice before relying on an exemption. Publicity, donor reports and research on the same children fall outside it.

Exempt purposes that may fit NGO work

Parental consent and the tracking ban also do not apply to some purposes, such as carrying out a duty under a law in a child's interest, or delivering a State benefit to a child.

Part B also lists an email-only account, real-time location for the child's safety, keeping harmful content away from a child, and checking that a user is not a child; each is restricted to what that purpose needs. The Schedule does not name the laws it has in mind, so if you act under a child protection or education statute, identify the exact provision that gives you the power or duty. The State-benefit item refers to s.7(b), a ground for the State and its instrumentalities, so it is most relevant when you deliver a scheme on a department's behalf.

Children without parents

For children in shelters or institutional care, the Act points to the lawful guardian. It does not say who that is, so get legal advice for your setting.

The Explanation to s.9(1) says 'consent of the parent' includes consent of the lawful guardian wherever applicable, and s.2(j) treats the guardian as part of the Data Principal. Rule 10 gives no separate procedure for guardians of children, and guardianship is decided under other laws that this guide does not cover. Until you have advice, collect the minimum, and remember that the no-harm rule in s.9(2) applies whoever consents.

Adults with disability and guardians

For a person with disability who has a lawful guardian, the guardian gives verifiable consent. You must take due care to check that the guardian was properly appointed.

s.9(1) applies only to a person with disability 'who has a lawful guardian'. Rule 11 defines the term narrowly: a person with a long-term impairment, or a condition covered by the National Trust Act, 1999 such as autism or cerebral palsy, who despite adequate and appropriate support is unable to take legally binding decisions. The guardian must be appointed under the Rights of Persons with Disabilities Act, 2016 or the National Trust Act, 1999. Disability alone does not move consent to someone else; where there is no such guardian, the person consents for themselves, and you may need to adapt the notice, for example by reading it aloud.

Photos and stories of children

A child's photo or story is personal data. Get the parent's specific consent for publicity, separate from services, and publish nothing likely to harm the child.

Publicity is a different purpose from delivering a service, so it needs its own specific consent (s.6(1)) from the parent or guardian (s.9(1)); no Fourth Schedule exemption covers fundraising or communications. Consent can be withdrawn at any time (s.6(4)), so keep a list of where each photo or story is published and be ready to take it down from your own channels. s.9(2) applies even with consent, so think about stigma and safety before naming a child's village, school, illness or history. Other laws and your own child protection policy may be stricter; this guide covers only the DPDP Act.

In one line

That covers children and guardians. Next: sharing data with funders, partners and researchers.