Rule 11Children's Data & Verifiable Consent
Exemptions for specified processing of children's data
What the Rule sets out
Carves out defined, lower-risk contexts — such as healthcare and educational institutions performing functions strictly necessary for their core services, or platforms that can demonstrate verifiably safe processing — from the full weight of Section 9, subject to purpose limitation.
What this means in practice
- This exemption is narrow and purpose-bound — it does not generally exempt marketing, analytics, or ad-tech layered on top of an otherwise-exempt core service.
Summarised for practical use from the publicly notified DPDP Rules, 2025. Confirm exact clause text against the official Gazette notification before relying on it for compliance decisions.