Blog

Parental Consent Isn’t Always Required for Children’s Data

Oct 26, 2026 · vDPO Team

India’s Digital Personal Data Protection (DPDP) Act requires verifiable parental consent for children’s personal data. But there are exceptions.

Rule 12 and the Fourth Schedule provide exemptions for specified classes of Data Fiduciaries and processing purposes.

Examples include:

  • Healthcare establishments processing children’s data to provide necessary health services.
  • Educational institutions undertaking permitted tracking or behavioural monitoring for educational activities or child safety.
  • Processing necessary to determine a child’s real-time location for safety, protection or security.

The exemptions are subject to specific conditions.

They also cover only specified obligations, including parental consent and restrictions under Section 9(3). Other applicable obligations continue.

The takeaway: Before implementing parental consent across every children’s data workflow, identify whether a specific exemption applies and document its conditions.

This article is general information, not legal advice.

Read next

Children

Parental Consent Doesn’t Authorise Targeted Advertising to Children

Even if a parent gives consent, a company generally cannot target advertisements at their child under India’s DPDP Act.
Children

Verifying a Parent’s Age Creates an Unusual Privacy Challenge

To protect a child’s personal data, a company may first need to process more personal data about the parent.
Product

Do you know which privacy risks need attention first?

vDPO Risk Register: Turn privacy concerns into accountable action.