DPDP Insights › Questions › Do we process children's data, and what changes if we do?

Question

Do we process children's data, and what changes if we do?

Short answer: Check every channel; children often appear where you least expect

Anyone under 18 is a child under the Act. For a child's data you need verifiable consent from a parent or lawful guardian, and you must not track, behaviourally monitor or show targeted ads to children. Some classes and purposes are exempt under Rule 12 and the Fourth Schedule, for example healthcare to the extent needed to protect the child's health, and educational institutions for their educational work.

What the law says

Section 9 sets the duties. Rule 10 explains how to verify the parent. Rule 12 and the Fourth Schedule list the exemptions.

Section 9 · Rules 10, 12: For anyone under 18, get verifiable consent from a parent or lawful guardian, and do not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule exempt some classes and purposes, for example clinical establishments and healthcare professionals to the extent needed to protect the child's health.
Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.

Steps

Find where children's data enters: customers, dependants, interns, visitors, scholarships, app sign-ups.
Decide whether an exemption in the Fourth Schedule applies to that purpose.
Where none applies, add an age question and a parent-consent step.
Switch off tracking and targeted ads for under-18 users.
Record the decision for each channel.

Evidence to keep

Channel-by-channel note on children's data
Parent-consent records
Ad and tracking settings

Common mistakes

Assuming 'we are B2B, so no children'
Using the age 13 or 16 from foreign laws
Treating a tick-box from the child as parental consent

How it plays out by sector

Banking, financial services and insurance: Minor savings accounts and student loans involve children's data. Parent consent and no targeted offers apply.
IT, ITeS, BPO and GCC: Usually only if a client's service involves children, or in staff dependants' records.
Central government: ministries and departments: Scholarship, nutrition and school schemes involve children; Fourth Schedule exemptions may apply to some purposes.
Public sector undertakings and utilities: PSU schools and hospitals handle children's data.
Healthcare and hospitals: Paediatric care is exempt from parent-consent limits only to the extent needed to protect the child's health; marketing to parents of children is not.
Education: Most of your users are children; check which Fourth Schedule exemptions apply to each purpose.

From each seat

DPO / Privacy lead: Ask every team, not only marketing. Dependants, interns, scholarship applicants and visitors are where children's data usually hides.
Legal & compliance: Advise on whether a Fourth Schedule exemption applies to each purpose, and write the reasoning down.
Marketing department: Switch off targeting for under-18 audiences and avoid tracking them.
Legal department: Record the Fourth Schedule reasoning for each purpose.

What a good answer from management sounds like

“We know every place where children's data comes in. Where no exemption applies we have parent consent, and tracking is off for under-18s.” Effort and time: Light to medium · depends on channels.