Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsAny service that processes the data of under-18s is bound by Section 9, the sharpest DPDP-specific requirement there is.
In short
Under the DPDP Act, anyone under 18 is a child. Section 9 requires verifiable parental consent (Rule 10, via a government- or law-authorised identity/age or virtual-token mechanism) and bans tracking, behavioural monitoring and targeted ads at children outright. Rule 12 and the Fourth Schedule give only narrow, purpose-bound exemptions. Children-data penalties reach ₹200 crore.
What changes for this niche, and the specific rule it turns on.
Rule 10 requires verifiable consent from a parent or guardian, verified using reliable identity and age details or a virtual token issued by a government- or law-authorised entity, before processing a child's data.
Section 9(3) bans behavioural tracking, monitoring and targeted advertising at children, regardless of consent.
Rule 12 and the Fourth Schedule give narrow, conditional exemptions to certain fiduciary classes (clinical and mental-health establishments, healthcare and allied professionals, educational institutions, creche and child-transport providers) and defined purposes (child safety, state benefits, age assurance), disapplying only s9(1) and s9(3), never s9(2).
Gate accounts by age so you know when Section 9 applies, and treat not-aimed-at-children cautiously if children use it in practice.
Even where exempt, you must not process a child data in a way likely to harm their well-being (s9(2)).
Short, cite-able answers, mirrored in FAQPage schema.
Stand up age assurance and verifiable consent first.
The readiness check flags age-assurance, consent and tracking gaps.
Take the readiness check →Consultant-led and partner-backed.