Chapter 2 · Obligations of Data Fiduciary
Section 9 - Processing of personal data of children
Verifiable parental consent and a ban on trackingChildren get extra protection.
Download full Act (PDF)In plain English
Children get extra protection. Before processing the personal data of a child - anyone under eighteen - or of a person with a disability who has a lawful guardian, you must obtain verifiable consent from the parent or guardian. You must not process children's data in ways likely to harm their well-being, and you must not track them, monitor their behaviour, or direct targeted advertising at them. The Government can relax some of this for specified, verifiably safe purposes or raise the exempt age for trusted Fiduciaries.
An ed-tech app must obtain verifiable parental consent before signing up a 15-year-old, and cannot profile that student to serve targeted ads.
Key points
- 'Child' means under eighteen; processing needs verifiable parental or guardian consent.
- No processing likely to harm a child's well-being.
- No tracking, behavioural monitoring or targeted advertising directed at children.
- The Government may exempt specified safe uses or lower the age threshold for trusted Fiduciaries.
Official section text
Section 9. Processing of personal data of children.
The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.
A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.
The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.