# DPDP Rules 2025, Rules 10 and 11: verifiable parental consent

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rules-10-and-11-verifiable-consent-for-children-and-persons-with-disability/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rules 10 and 11, verifiable consent for children and persons with disability

**Rule 10(1):** the Data Fiduciary must adopt appropriate technical and organisational measures to
ensure **verifiable consent of the parent** is obtained before processing a child's personal data,
and must **observe due diligence** to check that the person identifying herself as the parent is an
**adult who is identifiable if required** in connection with any law in force in India, by
reference to:
- (a) **reliable details of identity and age already held** by the Data Fiduciary; or
- (b) details of identity and age **voluntarily provided**, either
  - (i) by the individual, or
  - (ii) through a **virtual token mapped to such details, issued by an authorised entity**.

**Rule 10(2)** definitions: "adult" is a person who has completed eighteen years. "Authorised
entity" is an entity entrusted by law or by the Central or a State Government with issuing identity
and age details or a virtual token mapped to them, or a person appointed or permitted by such an
entity, and includes details made available and verified by a **Digital Locker service provider**
(DigiLocker), an intermediary notified by the Central Government under the IT Act, 2000.

**Rule 11** applies the equivalent mechanism to a **person with disability who has a lawful
guardian**, with the guardian verified as duly appointed under the relevant disability or
guardianship law.

**Rule 12** and the **Fourth Schedule** carve out classes of Data Fiduciaries and purposes exempt
from s.9(1) and s.9(3), under the Act's s.9(4) power. This is where healthcare providers,
educational institutions, childcare providers and certain State functions typically sit, in each
case limited to specified purposes such as health services, education, transport safety tracking,
or issuing a subsidy or benefit. **Verify the Fourth Schedule directly before relying on any
exemption for a client.**

**Remember what Rule 12 cannot do:** s.9(4) permits exemption only from s.9(1) and s.9(3). The
s.9(2) prohibition on processing likely to cause **detrimental effect on a child's well-being** is
never exemptible.