Rule 12: Exemptions From Certain Obligations Applicable to Processing of Personal Data of Child
Rule 12 recognises that strict, verified parental consent for every single interaction isn't always practical — and carves out specific, narrow exemptions for specific classes of Data Fiduciary and purposes.
Quick summary
What Rule 12 says
- Sections 9(1) and 9(3) of the Act (verifiable parental consent, and the restriction on tracking, behavioural monitoring and targeted advertising directed at children) don't apply to processing of a child's personal data by the classes of Data Fiduciary specified in Fourth Schedule, Part A, subject to the conditions specified there.
- The same sections don't apply to processing of a child's personal data for the purposes specified in Fourth Schedule, Part B, subject to the conditions specified there.
Breaking it down
This is a short rule that does something important: it stops the strict child-data regime from accidentally blocking services children specifically need.
Two separate exemption routes. Part A of the Fourth Schedule exempts specific classes of Data Fiduciary outright (subject to conditions) — for example, healthcare professionals, clinical establishments, mental health establishments and allied healthcare professionals providing health services, or educational institutions, in defined contexts. Part B exempts specific purposes rather than classes — such as processing necessary for a child's safety, or to prevent access to age-inappropriate content.
It's not a blanket exemption from the whole Act. Rule 12 only lifts Sections 9(1) and 9(3) — verifiable consent and the no-tracking/no-targeted-ads rule. Every other DPDP obligation (notice, security safeguards, breach reporting, and so on) still applies in full to a child's data even where this exemption is in play.
Conditions still apply. Both Parts of the Fourth Schedule attach conditions to the exemption — it isn't unconditional just because an organisation falls into an exempt class or purpose.
Why this rule matters
Without an exemption like this, a school nurse's health record system or a child-safety app blocking harmful content could be forced into the same verified-parental-consent friction as a general-purpose social app collecting a child's data for advertising — even though the underlying purpose is protective, not commercial.
Real-world example
Who needs to care about this rule
- Healthcare providers, clinical and mental-health establishments serving children.
- Educational institutions processing student data in defined contexts.
- Child-safety and content-moderation services whose purpose is protective rather than commercial.
Common questions
Does Rule 12 exempt an organisation from all child-data obligations?
Who decides whether my organisation qualifies for this exemption?
Can a general-purpose app claim this exemption for advertising to children?
Related rules
Rule 11 — Verifiable Consent for Processing of Personal Data of Person With Disability Who Has Lawful Guardian
Read the previous rule in sequence.
Read Rule 11Rule 13 — Additional Obligations of Significant Data Fiduciary
Continue to the next rule in sequence.
Read Rule 13Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rules