Section 9 of Digital Personal Data Protection Act, 2023 - Processing of Personal Data of Children
Section 9 creates special safeguards for processing the personal data of children and persons with disabilities who have lawful guardians. It addresses verifiable parental or guardian consent, harmful processing, tracking, behavioural monitoring, targeted advertising and prescribed exemptions.
Meaning of important terms
Under Section 2 of the Act, a child means an individual who has not completed eighteen years of age. A Data Fiduciary is a person who, alone or together with others, determines the purpose and means of processing personal data. For a child, the expression Data Principal includes the parent or lawful guardian of that child.
Section 9 - statutory provisions
Section 9(1): Verifiable consent
Before processing personal data of a child, or of a person with disability who has a lawful guardian, the Data Fiduciary must obtain verifiable consent of the parent or lawful guardian in the prescribed manner.
The statutory explanation clarifies that the expression "consent of the parent" includes the consent of a lawful guardian wherever applicable.
Section 9(2): Detrimental effect on a child
A Data Fiduciary must not undertake processing of personal data that is likely to cause a detrimental effect on the well-being of a child.
Section 9(3): Tracking, behavioural monitoring and targeted advertising
A Data Fiduciary must not undertake tracking or behavioural monitoring of children or targeted advertising directed at children, subject to the statutory and prescribed exemptions.
Section 9(4): Prescribed exemptions
Sub-sections (1) and (3) do not apply to such classes of Data Fiduciaries, or for such purposes and subject to such conditions, as may be prescribed. The Digital Personal Data Protection Rules, 2025 contain the detailed framework for specified exemptions.
Section 9(5): Exemption based on verifiably safe processing
The Central Government may, where satisfied that a Data Fiduciary processes children's personal data in a verifiably safe manner, notify an age above which that Data Fiduciary may be exempt from all or specified obligations under sub-sections (1) and (3), to the extent stated in the notification.
Digital Personal Data Protection Rules, 2025
The Digital Personal Data Protection Rules, 2025 supplement the Act. Their provisions dealing with verifiable consent require measures designed to establish that the person giving consent on behalf of a child is the child's parent and is an identifiable adult. The Rules also prescribe exemptions for specified classes of Data Fiduciaries and purposes, subject to stated conditions.
Practical effect of Section 9
Once Section 9 and the corresponding operative rules commence, organisations processing children's personal data will need to examine age-related data flows, the method used to obtain and verify parental or guardian consent, whether processing could adversely affect a child's well-being, and whether any tracking, behavioural monitoring or targeted advertising falls within the statutory prohibition or a valid prescribed exemption.
Official legal resources
For authoritative and updated text, refer to the official sources linked in the sidebar, including India Code for the Digital Personal Data Protection Act, 2023 and the Ministry of Electronics and Information Technology for the Digital Personal Data Protection Rules, 2025 and commencement materials.