# Section 9 DPDP Act 2023: Processing of personal data of

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/act/section-9/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

**CHAPTER II: OBLIGATIONS OF DATA FIDUCIARY.** The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), section 9. Verbatim from the Gazette of India.

Summary (maintainers', not statutory text): Verifiable parental consent; no detrimental processing; **no tracking/behavioural monitoring/targeted ads**; Rules may exempt (1) and (3) only; s.9(5) age notification

## Section 9. Processing of personal data of children

(1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability
who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as
the case may be, in such manner as may be prescribed.

> *Explanation.*—For the purpose of this sub-section, the expression "consent of the parent" includes the
> consent of lawful guardian, wherever applicable.

(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any
detrimental effect on the well-being of a child.

(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted
advertising directed at children.

(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a
child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be
prescribed.

(5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of
personal data of children is done in a manner that is verifiably safe, notify for such processing by such
Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any
of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the
notification may specify.