Section 9 — Processing of personal data of children

What this section requires

Before processing personal data belonging to a child, or to a person with disability who has a lawful guardian, a Data Fiduciary must obtain verifiable consent from a parent or that lawful guardian.

Two things are flatly barred regardless of consent: processing likely to cause a child any detrimental effect on her well-being, and tracking, behavioural monitoring, or targeted advertising directed at children.

The Central Government can prescribe classes of Data Fiduciaries or purposes exempt from the verifiable-consent and no-tracking rules, and can notify an age threshold above which a specific Data Fiduciary is exempt from these duties, once it's satisfied that fiduciary's processing of children's data is verifiably safe.

Who it applies to

Every Data Fiduciary processing the personal data of anyone under 18, or of a person with disability who has a lawful guardian — regardless of sector, unless a specific exemption under Rule 12 applies.

Checklist

• Obtain verifiable parental or guardian consent before processing, per Rule 10's mechanisms once in force.
• Never run tracking, behavioural monitoring, or targeted advertising directed at children, even with consent.
• Check Rule 12's exemption list before assuming the verifiable-consent duty applies in full — it exempts specific classes (clinical establishments, schools, crèches, school-transport operators) for narrowly scoped processing tied to health, safety, or education, and specific purposes (government benefits in a child's interest, email-account creation, real-time location for safety, age-gating itself) regardless of who the fiduciary is.
• Don't rely on an age-threshold exemption unless the Central Government has actually notified it for your organisation by name — it isn't a general safe harbour.

Penalty exposure

Breach of Section 9's obligations carries a monetary penalty of up to ₹200 crore, per item 3 of the Schedule to Section 33.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).