Building Verifiable Parental Consent Under Rule 10

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), anyone under 18 is a child, and a business needs "verifiable consent" from a parent before processing a child's personal data (s.9(1)). Rule 10 of the DPDP Rules, 2025, which commences on 13 May 2027, says how, leaving most of the design to the data fiduciary, the business deciding why and how data is processed. Trayambic's article on children's data in schools and ed-tech covers whether section 9 applies.

Two routes, four scenarios

Rule 10(1) requires "appropriate technical and organisational measures" and due diligence to check that the person identifying herself as the parent is an adult, by reference to:

• (a) reliable identity and age details of her that you already hold; or
• (b) identity and age details she provides voluntarily, herself or through a virtual token issued by an authorised entity.

The Rules' four illustrations use a child (C), her parent (P) and a platform (DF):

Where the child starts, DF must let the parent identify herself "through its website, app or other appropriate means".

What due diligence means in practice

Authorised entity. Rule 10(2)(b) means a body entrusted by law, or by the Central or a State Government, with issuing identity and age details or a token mapped to them, or a person it appoints or permits to issue them. It also covers details or tokens verified and made available by a Digital Locker service provider, such as DigiLocker. In our view a private vendor that merely reads an uploaded document is your data processor, acting on your behalf, not an authorised entity.

Reliable details. In our view this means details someone verified, as in a KYC-checked account. A typed date of birth does not qualify. Nor does an OTP, which proves only control of a phone, or a card payment, since RBI lets minors aged ten and above operate savings accounts.

What is not required. Rule 10 checks adulthood, not parenthood, and does not mandate Aadhaar. The adult must be "identifiable if required in connection with compliance with any law"; in our view a token reference meets that, without storing her ID. Take a declaration of the relationship: a false one is, in our view, impersonation under s.15(b), with a penalty of up to ₹10,000.

Part B of the Fourth Schedule exempts the age question and the Rule 10 check themselves from s.9(1) and (3), to the extent necessary.

Build it in six steps

1. 1.Ask for a date of birth, or month and year, so you know who is a child and when she turns 18.
2. 2.Hold a child's sign-up as pending, collecting only the parent's contact until consent is verified.
3. 3.Route the parent: Case 1 or 3 if you hold her verified details; otherwise a token, with an uploaded document only as fallback.
4. 4.Show her a standalone notice, with each optional purpose consented to separately.
5. 5.Log the result, not the evidence: route, issuer, token reference, outcome, timestamp, notice version and purposes. Delete uploaded images once checked; keep logs at least a year (Rule 6).
6. 6.Show the parent, in her own account, what she agreed to, with one-step withdrawal.

Section 6(10) puts the burden of proving consent on you; our article on notices and consent covers evidence-ready logs.

Withdrawal, the 18th birthday and guardians

Withdrawal. The parent is a data principal (the person the data relates to) for her child's data (s.2(j)), so she can withdraw as easily as she consented (s.6(4)). Stop processing, and make processors stop, within a reasonable time (s.6(6)), then erase what no law requires you to keep (s.8(7)). Warn her if the account will close (s.6(5)). Section 2(j) adds the parent rather than replacing the child, so in our view a child's own deletion request should be honoured too.

Turning 18. The Act is silent. In our view the parent's consent should not run on: a month ahead, show the young adult a fresh notice and seek her own consent; end the parent's access at 18; keep only the core service until she answers; and switch on nothing s.9(3) blocked, such as targeted advertising, without her opt-in.

Guardians. The Removal of Difficulties Order, 2026 confirms that s.9(1) covers a person with disability who has a lawful guardian. Rule 11 requires due diligence that a court, a designated authority under s.15 of the Rights of Persons with Disabilities Act, 2016, or a local level committee under s.13 of the National Trust Act, 1999 appointed the guardian. Record the order's reference and scope, not the diagnosis, and never assume a guardian: many adults with disability decide for themselves.

Lean checks, strong records

Rule 10 rewards a platform that knows little and checks well. Build the flow now, test it with a real parent and a 17-year-old, and keep the evidence lean.

Key takeaways

• Rule 10 checks that the person consenting for a child is an adult, using reliable details you already hold or details or a token from an authorised entity, such as a Digital Locker service provider.
• The four illustrations turn on who starts the sign-up (child or parent) and whether the parent is already a verified user.
• Keep the verification result, token reference and notice version, not copies of the parent's documents.
• A parent can withdraw at any time; stop processing, make processors stop and erase what no law requires you to keep.
• The Act is silent on turning 18; in our view seek the young adult's own consent and end the parent's access.