Rule 10: Verifiable Consent for Processing of Personal Data of Child
Rule 10 sets out exactly how a Data Fiduciary must check that the person consenting on behalf of a child is genuinely an identifiable adult parent — with four detailed illustrations covering the realistic ways this actually plays out.
Quick summary
What Rule 10 says
- A Data Fiduciary must adopt appropriate technical and organisational measures to ensure verifiable consent of the parent is obtained before processing a child's personal data, checking that the person identifying as parent is an identifiable adult.
- Verification can rely on: reliable identity/age details already available with the Data Fiduciary; or details voluntarily provided by the individual, or through a virtual token mapped to those details, issued by an authorised entity (including a Digital Locker service provider).
- “Adult” means someone who has completed eighteen years of age.
- “Authorised entity” includes an entity entrusted by law/government with issuing identity/age details or virtual tokens, or a Digital Locker service provider.
Breaking it down
The Rule's own four illustrations map almost exactly onto the real-world scenarios a product team will encounter:
Case 1: the parent is already a registered, verified user. A child tells the platform she's a child and names her parent; the parent identifies herself and confirms she's already a registered user with identity/ age details the platform already holds reliably. The platform checks those existing details — no new external verification needed.
Case 2: the parent identifies herself but isn't yet a registered user. Same start, but the parent isn't already registered. The platform must then check her identity/age against details issued by an entrusted entity or government body, or a virtual token mapped to them — she can use a Digital Locker service to supply this.
Case 3 & 4: the reverse flow, where the parent opens the account. The Rule also covers the parent initiating the account setup for the child directly, applying the same registered-vs-unregistered logic depending on whether the platform already holds her verified details.
The common thread: reliable verification, not just a checkbox. “I confirm I am the parent” as an unverified checkbox does not meet this Rule. The verification has to trace back to either data the platform already reliably holds, or an external, authorised identity/age source.
Why this rule matters
Children's data carries the highest compliance stakes in the entire framework — penalties for non-compliance with children's-data obligations can run up to ₹200 crore under the Act's Schedule. Getting parental verification right isn't optional polish; it's the gate that everything else about processing a child's data depends on.
Real-world example
Who needs to care about this rule
- Any product handling users under 18 — ed-tech, gaming, social platforms, children's content services.
- Identity and trust & safety teams building the actual verification flow.
- Legal teams assessing whether an existing “age gate” meets this bar (most simple checkboxes won't).
Common questions
Is a self-declared age checkbox enough to comply with Rule 10?
Can a platform use DigiLocker for this verification?
What if the parent is already a registered user of the platform?
Related rules
Rule 9 — Contact Information of Person to Answer Questions About Processing
Read the previous rule in sequence.
Read Rule 9Rule 11 — Verifiable Consent for Processing of Personal Data of Person With Disability Who Has Lawful Guardian
Continue to the next rule in sequence.
Read Rule 11Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rulesData Principal Rights
How rights and consent work for Data Principals generally, including children as a protected category.
Read about Data Principal rights