InfraVeritas360DPDPiqDPDP Insights › The law › Section 9 · Rules 10, 12
Section 9 · Rules 10, 12: Children's data
For anyone under 18, get verifiable consent from a parent or lawful guardian, and do not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule exempt some classes and purposes, for example clinical establishments and healthcare professionals to the extent needed to protect the child's health.
What it means in your sector
- Banking, financial services and insurance: Minor accounts and education loans for students under 18 need parent consent, and no targeted offers.
- Healthcare and hospitals: Rule 12 and the Fourth Schedule exempt clinical establishments and healthcare professionals from parent-consent and tracking limits, only to the extent needed to protect the child's health.
Questions where this section matters
- Do we process children's data, and what changes if we do?
- Can we send offers to past customers and leads?
- Townships, hospitals and schools run by the PSU: what applies?
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.