Data Privacy Laws For Businesses Handling Children's Personal Data In India

Children increasingly interact with digital platforms for education, entertainment, gaming, communication and financial services. As businesses collect names, photographs, contact details, location information, account credentials, academic records and behavioural information from young users, Children's Data Privacy has become a significant legal and governance issue in India. The Digital Personal Data Protection Act, 2023 introduces specific obligations for organisations processing children's personal data, including verifiable parental consent and restrictions on tracking, behavioural monitoring and targeted advertising. The Digital Personal Data Protection Rules, 2025 provide further operational detail.

For businesses, the issue is no longer limited to having a privacy policy. It involves understanding what data is collected, why it is collected, how parental consent is established, who receives the information, how long it is retained and how the organisation responds when something goes wrong.

What Is Children's Data Privacy Under Indian Law?

The Digital Personal Data Protection Act, 2023 defines a child as an individual who has not completed eighteen years of age. This is a considerably broader age threshold than some international privacy regimes. Section 9 of the Act creates additional safeguards specifically for processing personal data belonging to children. The Act applies to digital personal data. This includes information collected in digital form as well as personal data collected in non digital form and subsequently digitised, subject to the Act's scope and exclusions. For a business, this means a child's data should not be treated as an ordinary customer dataset. The organisation needs to determine whether the user is a child, whether parental consent is required, whether an exemption applies and whether the proposed processing could adversely affect the child's well being. The Supreme Court's privacy jurisprudence also provides an important constitutional backdrop. In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, the Supreme Court recognised privacy as a fundamental right. The later judgment specifically discussed the importance of protecting children's digital footprints and recognised the need for special protection for children's privacy.

India's Current Legal Framework for Children's Data Privacy

India's principal statutory framework is the Digital Personal Data Protection Act, 2023, supported by the Digital Personal Data Protection Rules, 2025. The Act establishes the concepts of Data Fiduciaries and Data Principals. A business deciding the purpose and means of processing personal data generally falls within the role of a Data Fiduciary. A child whose personal data is processed is a Data Principal. Section 9 is the central provision for children's data. It requires the Data Fiduciary to obtain verifiable consent from the parent or lawful guardian before processing a child's personal data. The provision also prohibits processing likely to cause a detrimental effect on the well being of a child. In addition, it prohibits tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exemptions. This framework is important for more than children's apps. EdTech platforms, healthcare providers, gaming businesses, e commerce platforms, social platforms, educational institutions, childcare providers and businesses offering services to families may all need to examine whether their activities involve children's personal data.

When Do the Children's Data Provisions Take Effect?

This point requires particular care because the DPDP Act and Rules have a phased commencement structure. The Central Government issued the commencement notification on 13 November 2025. Several institutional provisions came into force immediately. However, Sections 3 to 5, most of Section 6, Sections 7 to 17 and several other substantive provisions, including Section 9 dealing specifically with children's personal data, are scheduled to come into force eighteen months after 13 November 2025. This places the scheduled commencement of Section 9 on 13 May 2027. The same phased approach applies to the relevant provisions of the DPDP Rules, 2025. Rule 10, which deals with verifiable consent for processing children's personal data, falls within the provisions scheduled to commence eighteen months after publication. As of August 2026, businesses therefore have an important preparation window. The fact that the principal children's data obligations are not yet fully operational does not make preparation unnecessary. Organisations handling children's information should use the transition period to redesign their systems, contracts, consent mechanisms and governance arrangements.

What Does Verifiable Parental Consent Mean?

Parental consent under the DPDP framework is more demanding than simply displaying a checkbox stating, "I am the parent". The 2025 Rules provide an operational mechanism for verifying the person providing consent. Rule 10 requires a Data Fiduciary to adopt appropriate measures to verify whether the person giving consent is the parent or lawful guardian and whether the person is an identifiable adult. The Ministry's explanatory note refers to reliable identity details and virtual tokens mapped to such details. The Rules also contemplate situations where a parent is already registered with the service and circumstances where identity details may need to be provided through mechanisms such as Digital Locker. For businesses, the practical challenge is significant. The consent journey must be reliable without collecting excessive information from parents merely to establish their authority. An organisation should therefore consider data minimisation while designing parental verification. Collecting more identity information than necessary may create a second privacy problem while attempting to solve the first.

Restrictions on Tracking and Behavioural Monitoring

One of the most significant aspects of India's children's privacy regime is the restriction on tracking and behavioural monitoring. Businesses often rely on analytics tools to understand how users interact with their websites or applications. They may use cookies, device identifiers, location signals, engagement histories or other technical information to understand user behaviour. Where a user is a child, these practices require careful examination.

Section 9(3) expressly prohibits tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exemptions. This creates an important distinction between providing a service and profiling its users. An educational platform may need certain information to provide lessons, assess performance or maintain account security. It does not automatically follow that the same platform can use the child's behavioural information to build advertising profiles. Businesses should map every category of analytics and advertising technology used on a child facing service. Third party SDKs and advertising technologies deserve particular attention because a company may remain responsible for how personal data is processed even where technical processing is performed through external vendors.

Can Schools, Healthcare Providers and Childcare Businesses Rely on Exemptions?

The DPDP Rules recognise certain exemptions from some of the obligations under Section 9.

The Fourth Schedule contains specific classes of Data Fiduciaries and prescribed conditions. These include certain healthcare establishments and professionals, educational institutions and childcare providers. The exemptions are purpose specific and subject to conditions. This distinction is important. An educational institution cannot assume every form of data processing is automatically exempt simply because it is a school. The relevant processing must fall within the prescribed class and purpose. For example, processing necessary for educational activities may be treated differently from using children's information for unrelated commercial profiling or promotional activities. Businesses should therefore document the precise statutory basis for relying on an exemption rather than treating an exemption as a blanket permission.

Privacy Notices Must Be Designed for the Actual Processing

A privacy notice should tell users what information is being collected and why it is needed. Under the 2025 Rules, the notice requirements include clear and understandable information about the personal data being processed and the specific purpose for processing. The notice also needs to provide a means through which the Data Principal can access relevant information and exercise applicable rights. For children's services, the consent experience should be designed around the parent or lawful guardian where parental consent is required. A lengthy privacy policy hidden behind multiple links is unlikely to provide a strong operational solution. The business should separate the legal document from the actual user journey. The consent interface, privacy notice, account creation process and internal records should tell the same story.

Data Minimisation Becomes Especially Important

Children's privacy compliance is not simply about obtaining consent. Businesses should ask whether each item of information is genuinely necessary for the service. If a platform needs an email address to create an account, collecting detailed location information may require separate justification. If a learning service needs assessment results, collecting unrelated behavioural information may increase legal and security exposure. Data minimisation also reduces the consequences of a breach. A business cannot lose information it never collected. This principle should be reflected in product design, database architecture, analytics configuration and vendor contracts.

Security Safeguards and Children's Personal Data

The sensitivity of children's information makes information security a central compliance concern. The DPDP Act requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches. The statutory schedule allows a penalty of up to ₹250 crore for breach of the obligation concerning reasonable security safeguards. A breach of the additional obligations relating to children can attract a penalty of up to ₹200 crore. These figures demonstrate why cybersecurity cannot be treated solely as an IT issue. A business handling children's information should consider access controls, encryption where appropriate, authentication, secure development practices, logging, vulnerability management, backup security and incident response procedures. Employees should also understand how children's information is handled. Human error remains a significant source of privacy incidents.

Vendor and Third Party Risk

Many businesses do not process all personal data internally. Cloud service providers, analytics companies, customer relationship platforms, communication tools, payment providers and software developers may process information on behalf of the business. This creates contractual and operational risk. A company should know which vendors receive children's personal data, what information they receive, why they receive it, where it is processed and how it is deleted. Vendor agreements should address confidentiality, security obligations, permitted processing, incident reporting, subcontracting, deletion and assistance with regulatory requirements. A privacy programme is only as strong as its weakest significant data processor.

What Happens When a Data Breach Occurs?

A business should have an incident response plan before a breach occurs.

The response should identify who investigates the incident, who decides whether notification is required, who communicates with affected individuals and who liaises with regulators or authorities where necessary. The DPDP Act contains specific obligations concerning personal data breaches and provides penalties for failure to comply with applicable notification requirements. For businesses serving children, incident response should also consider the potential real world consequences of disclosure. A leaked email address is one concern. Exposure of a child's location, school information, photographs or behavioural profile can create substantially different risks. The response should therefore be proportionate to the nature of the information involved.

Children's Data and Artificial Intelligence

The growth of artificial intelligence creates another layer of complexity. Businesses may use children's information to train models, personalise educational content, generate recommendations or analyse performance. Before doing so, the business should identify the purpose of processing and determine whether the proposed use is permitted under the applicable legal framework. Using data collected for education to train a commercial model may raise questions about purpose, notice, consent and fairness. The business should not assume the original consent automatically covers every later use. Data governance should therefore extend to AI systems, analytics tools and automated decision making processes.

How Businesses Should Prepare Before the Rules Fully Apply?

Businesses handling children's personal data should begin with a data mapping exercise. The organisation should identify where children's data enters its systems, what categories are collected, which teams access it, which vendors receive it, where it is stored and when it is deleted. The next step should be an assessment of the user journey. If parental consent will be required, the organisation should determine how it will identify children, verify parents and maintain evidence of consent without collecting unnecessary information. The organisation should then review its advertising and analytics architecture. Tracking technologies directed at children's activity require particular scrutiny because Section 9 specifically addresses behavioural monitoring and targeted advertising. Contracts should also be reviewed. Vendor agreements, data processing arrangements, confidentiality clauses and security obligations should reflect the organisation's actual data practices. Finally, internal accountability should be established. Someone should be responsible for maintaining the data inventory, reviewing privacy controls, managing incidents and keeping the business informed about regulatory developments.

Why Businesses Should Not Wait Until May 2027?

The eighteen month transition period may appear generous, but privacy compliance is rarely solved by changing a single document. A business may need to modify its application, database, consent architecture, vendor arrangements, marketing technology, privacy notices and internal procedures. Technology changes take time. Vendor negotiations take time. Product teams need time to test new consent flows. Early preparation also allows businesses to identify practices which may be commercially attractive but legally difficult to defend. India's data protection regime is moving towards a more structured accountability model. Businesses should therefore treat children's privacy as a product governance issue rather than a compliance formality. Organisations looking for guidance on India's evolving data protection laws should rely primarily on the legislation, notified Rules, government notifications and authoritative regulatory material.

The Role of Legal and Compliance Teams

Legal review should not begin only after a privacy incident. Where a business regularly handles children's information, legal advisers should work with product, technology, security and marketing teams from an early stage. The role of commercial lawyers can extend beyond drafting privacy notices. They can help assess contractual arrangements, advertising models, vendor obligations, consent mechanisms, regulatory exposure and commercial implications of data processing practices.

A good legal review asks practical questions.

• What is the business trying to achieve?
• What information does it actually need?
• What legal basis supports the processing?
• Is parental consent required?
• Can the same objective be achieved with less information?
• Who else receives the data?
• What happens if the user withdraws consent?
• How will the company respond to a breach?

These questions connect legal compliance with actual business operations.

Key Takeaway

India's approach to children's personal data is moving towards stronger accountability and more active protection. The DPDP Act, 2023 places particular emphasis on verifiable parental consent, child wellbeing and restrictions on tracking, behavioural monitoring and targeted advertising. The DPDP Rules, 2025 add practical mechanisms for implementing these requirements. For businesses, compliance should begin with understanding the data lifecycle. The organisation needs to know what information it collects, why it needs it, who can access it, which third parties receive it and when it should be deleted. Product design, cybersecurity, contracts and legal governance should then work together. The strongest approach is not to treat children's privacy as a document prepared shortly before a regulatory deadline. It is to build privacy safeguards into the way the business collects and uses information from the outset.

Frequently Asked Questions (FAQs)

Q1. What is Children's Data Privacy in India?

Children's Data Privacy refers to the legal and organisational safeguards applicable when businesses process personal data relating to individuals below eighteen years of age. The DPDP Act, 2023 contains specific protections for children's personal data.

Q2. What age is considered a child under the DPDP Act?

Under the DPDP Act, a child is an individual who has not completed eighteen years of age.

Q3. Is parental consent required to process children's personal data?

Section 9 requires verifiable consent from a parent or lawful guardian before processing a child's personal data, subject to prescribed exemptions.

Q4. Can businesses use targeted advertising for children?

Section 9 prohibits targeted advertising directed at children, subject to the exemptions prescribed under the law. Businesses should therefore review advertising technology carefully before using it in services accessed by children.

Q5. Is behavioural tracking of children allowed in India?

Section 9 of the DPDP Act prohibits tracking or behavioural monitoring of children, subject to prescribed exemptions.

Q6. When will Section 9 of the DPDP Act become effective?

Section 9 is scheduled to come into force eighteen months after 13 November 2025, meaning the scheduled commencement date is 13 May 2027, subject to any subsequent government notification or change.

Q7. Do educational institutions have any exemptions?

The DPDP Rules provide specified exemptions for certain classes of Data Fiduciaries, including educational institutions, subject to prescribed conditions and purposes. The exemption should not be treated as a blanket exemption from all privacy obligations.

Q8. What penalties can apply for violating children's data obligations?

The Schedule to the DPDP Act provides for a penalty of up to ₹200 crore for breach of the additional obligations relating to children under Section 9. Other breaches can attract different maximum penalties.

Q9. Does a privacy policy alone make a business compliant?

No. A privacy policy is only one component of a wider privacy framework. Businesses also need appropriate consent mechanisms, data governance, security controls, contractual safeguards, retention practices and processes for handling rights requests and incidents.

Q10 Should startups prepare for children's data obligations before they become effective?

Yes. Businesses handling children's personal data should use the transition period to review their products, consent mechanisms, technology, contracts and internal controls. Waiting until the statutory provisions become operational may leave insufficient time for meaningful implementation.