Children's Data under the DPDP Act

The Digital Personal Data Protection Act, 2023 treats an individual below 18 years as a child. Children's digital personal data receives the Act's general protections as well as special safeguards concerning parental consent, harmful processing, monitoring and advertising. These duties principally apply to the Data Fiduciary that determines the purpose and means of processing.

Coverage and parental consent

Under Section 9, a Data Fiduciary must obtain verifiable consent from the child's parent before processing the child's personal data, in the prescribed manner. For this purpose, “parent” includes a lawful guardian.

• The parent or lawful guardian is treated as the Data Principal when the individual concerned is a child.
• General rights concerning access to information, correction, erasure and grievance redressal remain applicable.

Prohibited processing practices

A Data Fiduciary must not process personal data in a manner likely to have a detrimental effect on the child's well-being. It must also not undertake tracking or behavioural monitoring of children or direct targeted advertising at them.

• General duties such as reasonable security safeguards and personal-data-breach notification also protect children's data.
• These obligations place responsibility on the Data Fiduciary rather than expecting children to assess complex digital risks.

Exemptions and enforcement

The Central Government may prescribe limited exemptions from parental consent and the prohibitions on tracking and targeted advertising for specified fiduciaries or purposes, subject to conditions. It may also exempt a Data Fiduciary from specified child-data obligations above a notified age if its processing is shown to be verifiably safe.

• Non-fulfilment of obligations relating to children may attract a monetary penalty of up to Rs 200 crore under the Schedule.
• The Data Protection Board of India determines contraventions and may impose monetary penalties after inquiry.