Rule 10 of DPDP Rules 2025

Verifiable consent for processing of personal data of child or of person with disability who has lawful guardian.


(1) A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India, by reference to—
(a) reliable details of identity and age available with the Data Fiduciary; or
(b) voluntarily provided details of identity and age or a virtual token mapped to the same, which is issued by an entity entrusted by law or the Central Government or a State Government with the maintenance of such details or a person appointed or permitted by such entity for such issuance, and includes such details or token verified and made available by a Digital Locker service provider.
Illustration
C is a child, P is her parent, and DF is a Data Fiduciary. A user account of C is sought to be created on the online platform of DF, by processing the personal data of C.
Case 1: C informs DF that she is a child. DF shall enable C’s parent to identify herself through its website, app or other appropriate means. P identifies herself as the parent and informs DF that she is a registered user on DF’s platform and has previously made available her identity and age details to DF. Before processing C’s personal data for the creation of her user account, DF shall check to confirm that it holds reliable identity and age details of P.
Case 2: C informs DF that she is a child. DF shall enable C’s parent to identify herself through its website, app or other appropriate means. P identifies herself as the parent and informs DF that she herself is not a registered user on DF’s platform. Before processing C’s personal data for the creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the Government with maintenance of the said details or to a virtual token mapped to the same, check that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital Locker service provider.
Case 3: P identifies herself as C’s parent and informs DF that she is a registered user on DF’s platform and has previously made available her identity and age details to DF. Before processing C’s personal data for the creation of her user account, DF shall check to confirm that it holds reliable identity and age details of P.
Case 4: P identifies herself as C’s parent and informs DF that she herself is not a registered user on DF’s platform. Before processing C’s personal data for the creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the Government with maintenance of the said details or to a virtual token mapped to the same, check that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital Locker service provider.
(2) A Data Fiduciary, while obtaining verifiable consent from an individual identifying herself as the lawful guardian of a person with disability, shall observe due diligence to verify that such guardian is appointed by a court of law, a designated authority or a local level committee, under the law applicable to guardianship.
(3) In this rule, the expression—
(a) “adult” shall mean an individual who has completed the age of eighteen years;
(b) “Digital Locker service provider” shall mean such intermediary, including a body corporate or an agency of the appropriate Government, as may be notified by the Central Government, in accordance with the rules made in this regard under the Information Technology Act, 2000 (21 of 2000);
(c) “designated authority” shall mean an authority designated under section 15 of the Rights of Persons with Disabilities Act, 2016 (49 of 2016) to support persons with disabilities in exercise of their legal capacity;
(d) “law applicable to guardianship” shall mean,—
(i) in relation to an individual who has long term physical, mental, intellectual or sensory impairment which, in interaction with barriers, hinders her full and effective participation in society equally with others and who despite being provided adequate and appropriate support is unable to take legally binding decisions, the provisions of law contained in Rights of Persons with Disabilities Act, 2016 (49 of 2016) and the rules made thereunder; and
(ii) in relation to a person who is suffering from any of the conditions relating to autism, cerebral palsy, mental retardation or a combination of such conditions and includes a person suffering from severe multiple disability, the provisions of law of the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999 (44 of 1999) and the rules made thereunder;
(e) “local level committee” shall mean a local level committee constituted under section 13 of the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999 (44 of 1999);
(f) “person with disability” shall mean and include—
(i) an individual who has long term physical, mental, intellectual or sensory impairment which, in interaction with barriers, hinders her full and effective participation in society equally with others and who, despite being provided adequate and appropriate support, is unable to take legally binding decisions; and
(ii) an individual who is suffering from any of the conditions relating to autism, cerebral palsy, mental retardation or a combination of any two or more of
such conditions and includes an individual suffering from severe multiple disability.

Rule 11 →
DPDPA
Table of contents


Report error

Legal Interpretation: Rule 10 - Verifiable Consent for Processing Data

In a digital age where personal data is a valuable asset, safeguarding the rights of vulnerable groups like children and individuals with disabilities is of paramount importance. Rule 10 of the DPDP Rules 2025 sets a robust framework to ensure that verifiable consent is obtained from lawful guardians before processing their personal data. Let’s delve into the specifics of this rule, breaking it down with relatable scenarios and practical insights.

Why Verifiable Consent Matters

Think of personal data as a treasure chest. For children and individuals with disabilities, their guardians act as the keys to that chest, ensuring it’s accessed responsibly. Verifiable consent isn’t just a bureaucratic hoop—it’s a critical safeguard to protect their privacy and autonomy. By requiring verifiable consent, Rule 10 establishes a safety net that balances data utility with individual dignity.

Key Provisions of Rule 10

This rule outlines specific measures to ensure verifiable consent is obtained in two critical scenarios: processing data of children and processing data of individuals with disabilities.

  • Consent for Processing Children’s Data Data Fiduciaries must adopt technical and organizational measures to ensure consent is obtained from a child’s parent. This involves:
    • Verifying the identity and age of the individual identifying as the parent using reliable details already available or voluntarily provided by the guardian.
    • Using a virtual token or Digital Locker service to authenticate the parent’s identity when necessary.
  • Consent for Individuals with Disabilities When processing data for individuals with disabilities, the Data Fiduciary must ensure the guardian is legally appointed under applicable laws. This includes:
    • Verification of guardianship through court orders, designated authorities, or local level committees established under relevant legislation.
    • Observing due diligence to validate the guardian’s credentials.

Definitions for Clarity

The rule incorporates several key definitions to ensure precision:

  • Adult: An individual 18 years or older.
  • Digital Locker Service Provider: An intermediary providing verified identity details under the IT Act, 2000.
  • Designated Authority: Entities appointed under the Rights of Persons with Disabilities Act, 2016.
  • Law Applicable to Guardianship: Includes provisions under the Rights of Persons with Disabilities Act, 2016, and the National Trust Act, 1999.

Balancing Technology and Trust

Rule 10 leverages technology, like Digital Locker services and virtual tokens, to streamline verification processes. But it doesn’t lose sight of human accountability. By requiring identifiable, adult guardians to validate consent, it ensures that personal data isn’t mishandled or accessed without proper authorization.

Practical Implications for Data Fiduciaries

Compliance with Rule 10 is not just about ticking regulatory boxes. Here’s what Data Fiduciaries must focus on:

  • Robust Verification Mechanisms: Implement systems to verify parent or guardian identities, whether through existing data or government-authorized services.
  • Transparency and Communication: Clearly inform users (parents/guardians) about the verification process and the safeguards in place.
  • Record Maintenance: Maintain logs of consent obtained, verification methods, and interactions to ensure accountability in case of disputes.

Empowering Guardians

For parents and guardians, Rule 10 provides peace of mind. They can trust that their dependents’ data is handled with care, knowing they have control over consent. This empowerment is especially critical in a world where digital interactions are becoming the norm.

Global Comparisons

The framework outlined in Rule 10 aligns with global standards like the GDPR, which emphasizes parental consent for children’s data processing. By incorporating innovative solutions like Digital Locker services, India’s DPDP Rules, 2025, not only meet but advance these international benchmarks.

Conclusion

Rule 10 of the DPDP Rules 2025 exemplifies a thoughtful approach to data privacy. By mandating verifiable consent for vulnerable groups, it ensures that their rights are respected while enabling safe digital participation. For Data Fiduciaries, this rule is a call to innovate responsibly, fostering trust through robust safeguards and transparent practices. After all, in the realm of data privacy, trust is the ultimate currency.

Read more on BLOG : Childrens of illiterate parents BANNED from social media IN INDIA?

© 2025 Advocate (Dr.) Prashant Mali