Rule 10Children's Data & Verifiable Consent
Verifiable consent for children and persons with disability
What the Rule sets out
Verifiable parental or guardian consent may be obtained through reliable identity and age details already available with the Data Fiduciary, a virtual token mechanism linked to identity/age (such as through DigiLocker), or another government-notified mechanism, applying a risk-based approach depending on the volume and nature of processing.
What this means in practice
- Expect to integrate with a token-based age/identity verification flow rather than a simple self-declared birthdate field for anything beyond low-risk processing.
Summarised for practical use from the publicly notified DPDP Rules, 2025. Confirm exact clause text against the official Gazette notification before relying on it for compliance decisions.