Section 9(1): Verifiable Parental Consent & Guardian Verification

Statutory Text (Official Gazette)

Section 9(1), as amended: The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.

Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.

Amendment note: The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated October 5, 2026, in force on its publication in the Gazette, reported as October 6 or 7, 2026) inserted the word “of”, so the phrase reads “a child or of a person with disability”. The change only makes the wording clearer; it does not add new duties. Section 9 itself is not yet in force and is expected to apply from May 13, 2027.

Under Section 2(f), “child” means an individual who has not completed the age of eighteen years.

What Section 9(1) Means in Plain English

Section 9(1) establishes the strictest age threshold in global privacy law:

1. Everyone Under 18 Is a Child: Unlike the US (under 13) or the EU (under 13-16), Indian law classifies every individual under 18 years old as a child.
2. Simple Checkboxes Do Not Qualify: You cannot simply ask a 14-year-old to click “I confirm my parents agreed”. The law mandates verifiable consent—meaning you must have technical proof that the actual parent or legal guardian granted permission.
3. The October 2026 Wording Fix: The Removal of Difficulties Order only inserted the word “of”. The rule was already that a parent consents for a child and a lawful guardian consents for a person with disability; the order makes the sentence read that way without changing the duty.

Technical Methods for Verifiable Parental Consent

Rule 10 of the DPDP Rules 2025 (in force from May 13, 2027) says how to verify a parent. You must check that the person claiming to be the parent is an identifiable adult (18 or over), using either:

• Identity and age details you already hold: For example, if the parent is already a verified user of your platform.
• Details the parent provides voluntarily: Either directly, or through a virtual token issued by an authorised entity, including a DigiLocker service provider.

Note that Rule 10 verifies that the parent is an adult. It does not require proof of the parent-child relationship. A plain SMS OTP to a phone number does not, by itself, prove age.

For a person with disability, Rule 11 requires you to verify that the guardian was appointed by a court, a designated authority, or a local level committee under the applicable guardianship law.

← Back to Full Section 9: Children’s Data Guide