DigiLocker
The Government of India’s digital document service, mentioned in the Rules as one way to verify a parent’s age and identity.
DigiLocker is the Government of India's digital document service, where people keep issued documents such as ID and certificates and can share them with their consent. The Rules name Digital Locker service providers as a way to verify a parent.
Meaning of DigiLocker
Rule 10 refers to verification through a service such as DigiLocker, where a person can share issued documents or tokens without giving paper copies. Whether it fits your flow depends on your user base and its reach.
DigiLocker is a cloud-based service run under the Ministry of Electronics and Information Technology, where residents link their accounts and fetch documents issued by government departments and other issuers, such as driving licences, school-board certificates and tax records. Users can then share these documents electronically with a service that needs them, with their own authorisation, instead of uploading photocopies. The exact documents available and the rules for their legal validity are governed by the service's own framework and the IT Act, not the DPDP Act.
The DPDP Rules refer to it in the context of children's data. Rule 10 describes verification of a parent through details that the person provides voluntarily, or through a virtual token mapped to them, issued by an authorised entity. An authorised entity includes an entity entrusted by law or the Government with issuing identity or age details or tokens, and expressly includes a Digital Locker service provider. This gives product teams a recognised, government-backed way to confirm that a parent is an identifiable adult.
Using DigiLocker for this purpose is a choice, not an obligation. Rule 10 lists it as one acceptable route. A fiduciary may rely on reliable details it already holds, such as a long-standing verified customer account, or on another authorised entity. Choose DigiLocker if your users are likely to have an account and your flow can handle the sharing step, but also plan for users who do not.
Legal responsibility stays with the fiduciary. Receiving a verified credential does not discharge the duties of notice, purpose limitation, minimisation, security and erasure. If a parent shares more than you need, you should not retain the excess, and your notice should explain why verification is required. DigiLocker itself is a separate data controller for the data it holds, so your relationship with it should be documented in your integration terms.
Examples of DigiLocker
A parent proves her age to an edtech app by sharing a verified record from DigiLocker.
A coaching app invites parents to verify with DigiLocker. The parent signs in, approves sharing of age and identity confirmation, and the app activates the child's account. It keeps only the verified result and the date.
A game for teenagers uses DigiLocker as the main parent check but also supports verification through a parent's existing, already verified account, so families without a locker account are not shut out.
A bank opening a minor's savings account uses the guardian's existing KYC details, as Rule 10 allows for reliable details already held, and falls back to DigiLocker only when the guardian is a new customer.
Why DigiLocker matters
DigiLocker matters because it offers a low-friction route to something the Act demands. Children's data carries the highest penalty, up to ₹200 crore, and a weak consent process is the likeliest way to run into it. A recognised verification route helps show that reasonable technical and organisational measures were taken.
It also protects families. A parent who shares a token or a verified record through a trusted service reveals less than one who emails a scan of an ID card, and the app has less to protect or lose. That fits the minimisation and security duties in Section 8 and Rule 6.
How it works in practice
- 1Decide whether DigiLocker fits your audience. For a service aimed at urban families with smartphones it may work well; for others, offer an alternative path such as an existing verified account.
- 2Integrate through the official onboarding process and request only the attribute you need, for example confirmation of adult status, rather than the full document.
- 3Show the parent a plain notice before redirecting, explaining what will be shared, why and for how long the result will be kept.
- 4Store the outcome, timestamp and notice version, and discard the underlying document or details unless law requires you to keep them.
- 5Handle failures gracefully, with a helpful retry and support option, so a failed check does not push the family to use a fake account.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Pulling the entire document when only an age check is needed. Collect the least data that does the job.
Making DigiLocker the only route. Some parents have no account, and a single route leads to workarounds.
Assuming the integration transfers your compliance duties. The fiduciary still owns notice, security and retention for what it receives.
Compliance tips
Read the provider's current onboarding and data-sharing terms before design, because they set what you can request and store.
Keep a fallback verification route, documented and equally secure, for parents who cannot use DigiLocker.
Review your retention schedule so verification evidence is deleted on a fixed timeline.
Common questions about DigiLocker
Is DigiLocker mandatory under the DPDP Rules?
No. Rule 10 lists a Digital Locker service provider as one type of authorised entity whose details or tokens can be used. A fiduciary may use reliable details it already holds, or another authorised entity, as long as the check is dependable.
Is DigiLocker part of the DPDP Act?
No. It is a separate government service. The DPDP Rules only mention it as one route for verifying a parent. Its own terms and the IT framework govern how documents are issued and shared, while the DPDP Act governs what your organisation does with the data it receives.
Can I store the documents a parent shares through DigiLocker?
You should keep only what you need to show verification happened, such as the result, date and notice version. Retaining full documents without a clear purpose goes against minimisation and Section 8(7), and increases your exposure if there is a security incident.