To protect a child’s personal data, a company may first need to process more personal data about the parent.
Under Rule 10 of the Digital Personal Data Protection (DPDP) Rules, organisations must obtain verifiable parental consent before processing children’s personal data, where the requirement applies.
They must also check that the person identifying themselves as the parent is an identifiable adult.
This can involve:
- Reliable identity and age details already held by the organisation.
- Identity and age details voluntarily provided by the individual.
- Authorised virtual tokens mapped to identity and age details, including through eligible Digital Locker services.
This creates a practical design challenge.
How do you verify adulthood and obtain valid parental consent without unnecessarily collecting or retaining identity documents?
The takeaway: Parental consent mechanisms need careful identity-verification and data-minimisation design.
This article is general information, not legal advice.