Rules 10 and 11, verifiable consent for children and persons with disability

Rule 10(1): the Data Fiduciary must adopt appropriate technical and organisational measures to ensure verifiable consent of the parent is obtained before processing a child's personal data, and must observe due diligence to check that the person identifying herself as the parent is an adult who is identifiable if required in connection with any law in force in India, by reference to: - (a) reliable details of identity and age already held by the Data Fiduciary; or - (b) details of identity and age voluntarily provided, either - (i) by the individual, or - (ii) through a virtual token mapped to such details, issued by an authorised entity.

Rule 10(2) definitions: "adult" is a person who has completed eighteen years. "Authorised entity" is an entity entrusted by law or by the Central or a State Government with issuing identity and age details or a virtual token mapped to them, or a person appointed or permitted by such an entity, and includes details made available and verified by a Digital Locker service provider (DigiLocker), an intermediary notified by the Central Government under the IT Act, 2000.

Rule 11 applies the equivalent mechanism to a person with disability who has a lawful guardian, with the guardian verified as duly appointed under the relevant disability or guardianship law.

Rule 12 and the Fourth Schedule carve out classes of Data Fiduciaries and purposes exempt from s.9(1) and s.9(3), under the Act's s.9(4) power. This is where healthcare providers, educational institutions, childcare providers and certain State functions typically sit, in each case limited to specified purposes such as health services, education, transport safety tracking, or issuing a subsidy or benefit. Verify the Fourth Schedule directly before relying on any exemption for a client.

Remember what Rule 12 cannot do: s.9(4) permits exemption only from s.9(1) and s.9(3). The s.9(2) prohibition on processing likely to cause detrimental effect on a child's well-being is never exemptible.