What Is This Module For?
The Children's Data module helps you comply with the enhanced protections for processing personal data of individuals under 18 years of age under the DPDP Act 2023.
Which Law Requires This?
- DPDP Act 2023, Section 9 — Before processing personal data of a child, a Data Fiduciary must obtain verifiable parental consent. Processing that is detrimental to children's well-being is prohibited.
- DPDP Rules 2025, Rule 11 — Specifies how parental consent must be verified, and prohibits tracking, behavioural monitoring, and targeted advertising to children.
Penalty: Processing children's data without verifiable parental consent can attract penalties up to ₹200 crore.
Step-by-Step Guide
- Go to Children's Data in the sidebar under DPDP Compliance.
- Record each processing activity that may involve children — describe the data categories and verification method used.
- Mark the age verification method: ID upload, Aadhaar-based, parental declaration, or DigiLocker-based.
- Record parental consent separately for each child — upload the consent document or record the digital consent timestamp.
- Set review dates — dcomply flags records for annual review.
Common Mistakes to Avoid
- Relying on self-declaration of age — "I am 18+" checkboxes are not verifiable parental consent.
- Using children's data for targeted advertising — Prohibited under Rule 11 regardless of parental consent.
- Not having a documented age-gating mechanism — You must be able to demonstrate how you identify and protect child users.
Frequently Asked Questions
Q: What is a "child" under the DPDP Act?
A: Any person under 18 years of age (Section 2(e) of the DPDP Act 2023).
Q: What if we cannot determine the age of our users?
A: If you cannot reliably determine age and your service might be used by children, treat all users as potential children and implement the full parental consent process.