Rule 11: Verifiable Consent for Processing of Personal Data of Person With Disability Who Has Lawful Guardian

Quick summary

What Rule 11 says

• A Data Fiduciary must observe due diligence to verify that a person identifying as the lawful guardian of a person with a disability is genuinely appointed as such, under the applicable law of guardianship.
• “Law applicable to guardianship” covers appointments under the Rights of Persons with Disabilities Act, 2016 (for long-term physical, mental, intellectual or sensory impairments) or the National Trust Act, 1999 (for autism, cerebral palsy, mental retardation, or severe multiple disability).
• “Designated authority” means an authority designated under Section 15 of the Rights of Persons with Disabilities Act, 2016.
• “Local level committee” means a committee constituted under Section 13 of the National Trust Act, 1999.
• “Person with disability” is defined to include both categories above — individuals who, despite adequate support, are unable to take legally binding decisions independently.

Breaking it down

This rule is narrower and more legally specific than it might first appear:

It's about lawful guardianship, not caregiving in general. A family member who informally helps a person with a disability isn't automatically a “lawful guardian” for this Rule's purposes. The guardianship has to trace back to one of the specific legal appointment routes the Rule names.

Two different disability frameworks, two different appointing bodies. For long-term physical, mental, intellectual or sensory impairments generally, guardianship appointments run through a court or a designated authority under the 2016 Act. For autism, cerebral palsy, mental retardation or severe multiple disability specifically, appointments run through a local level committee under the 1999 National Trust Act. A Data Fiduciary verifying guardianship needs to check against the right framework.

The verification duty sits with the Data Fiduciary. It's not enough for someone to simply assert “I am her guardian.” The Data Fiduciary carries the due-diligence obligation to actually confirm the appointment before relying on that consent.

Why this rule matters

Persons with disabilities who require a guardian are a category the DPDP framework specifically protects from having someone falsely claim authority over their personal data. Rule 11 puts that protection into an actual verification duty, not just a policy statement.

Real-world example

Who needs to care about this rule

• Healthcare, insurance and welfare-services platforms that may deal with guardians consenting on behalf of patients.
• Compliance teams building guardian-verification processes distinct from the parental-consent flow in Rule 10.

Common questions

Related rules