Amended on 6 October 2026. In sub-section (1), “child or a person with disability” now reads “child or of a person with disability”. Source: S.O. 5458(E), the Removal of Difficulties Order, 2026. See the official text.
In simple words
For a child (under 18), the company must get verifiable consent from a parent before using the child's data. The same applies to a person with disability who has a lawful guardian. Companies must not process children's data in ways likely to harm them, and must not track, behaviourally monitor or target ads at children. Some exemptions apply under the Rules.
- What this means for you
- If your child uses an app, the app must check that you, a parent, agree first.
- What this means for businesses
- Build age and parental consent checks. Stop targeted ads and behavioural tracking for children unless an exemption in the Fourth Schedule applies.
- Everyday example
- A gaming app must get a parent's verifiable consent before creating an account for a 12-year-old.
सरल शब्दों में (हिन्दी अनुवाद)
बच्चे (18 साल से कम) के डेटा के इस्तेमाल से पहले कंपनी को माता पिता की सत्यापन योग्य सहमति लेनी होगी। यही बात उस दिव्यांग व्यक्ति पर लागू होती है जिसका कोई वैध अभिभावक है। कंपनियाँ बच्चों के डेटा को ऐसे तरीके से इस्तेमाल नहीं कर सकतीं जिससे उन्हें नुकसान होने की संभावना हो, और बच्चों को ट्रैक करना, उनके व्यवहार की निगरानी करना या उन्हें लक्षित विज्ञापन दिखाना मना है। नियमों के तहत कुछ छूट लागू होती हैं।
- आपके लिए इसका मतलब
- अगर आपका बच्चा कोई ऐप इस्तेमाल करता है, तो ऐप को पहले यह पक्का करना होगा कि आप, यानी माता पिता, सहमत हैं।
- कारोबार के लिए इसका मतलब
- उम्र और माता पिता की सहमति की जाँच की व्यवस्था बनाएँ। बच्चों के लिए लक्षित विज्ञापन और व्यवहार की ट्रैकिंग बंद करें, जब तक चौथी अनुसूची की कोई छूट लागू न हो।
- रोज़मर्रा का उदाहरण
- किसी गेमिंग ऐप को 12 साल के बच्चे का अकाउंट बनाने से पहले माता पिता की सत्यापन योग्य सहमति लेनी होगी।
This is our Hindi translation of the plain English summary above, not the official Hindi text of the Act. If they differ, the official text prevails.
Who it applies to
Data Fiduciaries processing data of children or of persons with disability who have a lawful guardian.
Related Rules
- Rule 10. Verifiable consent for processing of personal data of child From 13 May 2027
- Rule 11. Verifiable consent for processing of personal data of person with disability who has lawful guardian From 13 May 2027
- Rule 12. Exemptions from certain obligations applicable to processing of personal data of child From 13 May 2027
Related sections
Official textas notified
Source: MeitY copy of the Gazette (CG-DL-E-12082023-248045), page 8. Printed dashes are shown as colons; the wording is unchanged. Later amendments are shown in place and marked.
(1) The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Amended. In sub-section (1), the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E) dated 5 October 2026, Gazette of India Extraordinary, Part II, Section 3(ii), No. 5248, 6 October 2026) substituted “child or of a person with disability” for “child or a person with disability”. Official order. As originally notified: (1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Explanation. For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.
(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.
(5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.