Children's Data Processing Policy Template

CHILDREN'S DATA PROCESSING POLICY

[Organization Name]
Effective Date: [Effective Date] | Policy Owner: [DPO]

1. PURPOSE
This Policy sets out how [Organization Name] identifies, processes, and protects the personal data of children (individuals below 18 years of age) in compliance with Section 9 of the DPDP Act, 2023, which requires verifiable parental consent before processing a child's personal data and prohibits processing likely to cause detrimental effect on the wellbeing of a child, as well as behavioural monitoring and targeted advertising directed at children.

2. SCOPE
Applies to all products, features, and services offered by [Organization Name] that are directed at, or reasonably likely to be accessed by, children, including [App/Platform Name].

3. AGE VERIFICATION / AGE-GATING
   a. All new users must declare their date of birth at sign-up through a neutral age-gate that does not encourage falsification.
   b. Where our risk assessment indicates a meaningful likelihood of child users (e.g., education, gaming, or entertainment products), we deploy [age-estimation/verification method, e.g., document check, parental account linkage] in line with the mechanisms recognised under the DPDP Rules, 2025.
   c. Accounts identified or self-declared as belonging to a child under 18 are automatically routed to the parental consent flow described below before any further processing occurs.

4. VERIFIABLE PARENTAL CONSENT (VPC)
   a. Before creating a child's account or processing any of the child's personal data beyond what is necessary for the age-gate itself, we obtain verifiable consent from the child's parent or lawful guardian.
   b. VPC is collected via: [method, e.g., DigiLocker-linked identity verification, verified parent email plus payment-instrument micro-authorisation, or Consent Manager-facilitated verification], consistent with mechanisms prescribed under the DPDP Rules, 2025.
   c. The parent/guardian receives an itemised notice (per Section 5 principles) describing what data will be collected about the child, for what purpose, and for how long, before granting consent.
   d. Consent records (parent identity verification reference, timestamp, scope of consent) are retained to demonstrate compliance.

5. PROHIBITED PROCESSING
[Organization Name] shall not, in respect of any user identified as a child:
   a. Undertake behavioural monitoring or tracking of the child's activity for profiling purposes;
   b. Serve targeted or personalised advertisements based on the child's data or behaviour;
   c. Process the child's data in any manner likely to cause detrimental effect on the child's wellbeing.

6. EXEMPTED PROCESSING (if applicable)
Where [Organization Name] qualifies for any class exemption notified by the Central Government under Section 9(4) or (5) (e.g., for specific health, educational, or safety-related processing), such processing shall be documented separately with the specific notification relied upon, reviewed by Legal before being treated as exempt.

7. PARENTAL CONTROLS AND OVERSIGHT
Parents/guardians may, through [Parent Dashboard/Settings], review the data collected about their child, withdraw consent, and request erasure of the child's data at any time, with withdrawal taking effect within [X days].

8. AGE OF TRANSITION TO ADULT ACCOUNT
Upon a user turning 18 (or upon verified proof of age), the account transitions from parental-consent governance to standard consent mechanisms, and the user is prompted to review and re-consent to processing directly.

9. STAFF TRAINING
Employees involved in product design, marketing, or data engineering for products likely to be accessed by children receive training on this Policy and on Section 9 obligations at least annually.

10. AUDIT AND REVIEW
This Policy and associated age-verification/VPC mechanisms are reviewed [annually] and whenever the DPDP Rules, 2025 are amended, or product features materially change.

Approved by: [Name, Designation] Date: [Date]