Glossary · Children's Data
What Is Children's Data Under DPDPA?
Anyone under 18 is a child under DPDPA — including Class 12. Section 9 adds verifiable parental consent, a ban on tracking and targeted ads directed at children, and a well-being duty on top of the baseline. Schools, labs treating minors, and ed-tech all sit here. Build before the 2027 admission cycle.
Last reviewed: 13 August 2026
Definition
Children's data is personal data about anyone under eighteen. Section 2(f) of the DPDP Act, 2023 draws that line with no lower age bands, so a seventeen-year-old gets the same protection as a seven-year-old. Section 9 then adds three duties on top of everything you already owe. You must get verifiable consent from a parent or lawful guardian before processing (Section 9(1)). You must not process in a way likely to have a detrimental effect on a child's well-being (Section 9(2)). And you must not track children, monitor their behaviour, or direct targeted advertising at them (Section 9(3)). The same additional rules cover persons with disability who have a lawful guardian. Rule 10 sets how parental identity is verified; Rule 11 covers lawful guardians of persons with disability.
How this matters in practice
Schools sit on the hardest version of this: admission forms, Aadhaar copies, medical notes, photographs, bus GPS — collected from parents, about children, often over WhatsApp. Privigo runs the parent-consent flow with identity verification, scopes each consent to a stated purpose, and keeps the immutable record that proves who consented, to what, and when. Start with the school gap scan.
Frequently asked questions
How do I actually verify that the person consenting is the parent?
Rule 10 of the DPDP Rules, 2025 requires you to take reasonable due diligence to check that the adult giving consent is an identifiable adult who has completed 18 years. In practice that means one of three routes: reliable identity and age details you already hold; details voluntarily provided by that individual; or a virtual token mapped to those details issued by an authorised entity, including a Digital Locker service provider. A tick-box saying "I confirm I am a parent" is not verification. For schools the practical route is verifying the parent once at admission and binding later consents to that verified identity, rather than re-verifying per form. Persons with disability who have a lawful guardian go down the separate Rule 11 route.
My school takes attendance photos and runs GPS on the bus. Is that banned tracking?
Not necessarily. Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 read with Fourth Schedule Part A(3) and A(5), and Part B(4), carves out tracking and behavioural monitoring for an educational institution's educational activities, in the interests of enrolled children's safety, and real-time location for a child's safety — which covers transport monitoring during the journey and campus premises security. Two cautions: the carve-out is purpose-bound, so safety tracking is covered while sharing the same data with a vendor for engagement analytics is not; and the exemption is from tracking and monitoring only — it does not remove verifiable parental consent for admission, medical or photography processing, and it never touches Section 9(2). Nothing permits processing likely to have a detrimental effect on a child's well-being.
What does it cost if I get this wrong?
The Schedule to the DPDP Act, 2023 sets a penalty of up to ₹200 crore for breach of the additional obligations relating to children under Section 9. That slab stands on its own and is decided by the Board on the nature, gravity and duration of the breach — it is not added to the security-safeguards slab, which is a separate entry at up to ₹250 crore. Beyond the number, this is the one category where a complaint from a single angry parent is enough to start the process. Substantive obligations bite on 13 May 2027; for schools, the practical deadline is the admission cycle before that.
Free DPDPA gap scan for schools — and a badge for your website
Answer 20 questions about your admission form, your ed-tech vendors, your CCTV and transport tracking, and how you store student records. You get a written gap report scored against Section 9, Rule 10 and the security safeguards duty — no cost, no call required. Schools that clear the baseline get a DPDPA Ready badge to display for parents and at admissions.
Run the free gap scan
Talk to us
Takes 10 minutes. Report emailed to your Principal or Correspondent. Nothing published without your permission.
Disclaimer: Privigo is not a law firm. This page provides operational compliance guidance only. For institution-specific obligations, work with qualified Indian legal counsel.