Verifiable Parental Consent

Paraphrased legal text

A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before processing any personal data of a child, and shall observe due diligence to check that the individual identifying herself as the parent is an adult who is identifiable — by reference to reliable details of identity and age already available with the Data Fiduciary, or to details of identity and age (or a virtual token mapped to them) issued by an entity entrusted by law or by the Government, including details or a token made available by a Digital Locker service provider. (Paraphrased — see Rule 10 for the exact text.)

What this means in plain English

• Consent for a child's personal data must come from the parent or lawful guardian, and it must be verifiable — the child's own consent, or an unchecked self-declaration, is not enough.
• The Rule's due diligence is a check that the person consenting as the parent is an identifiable adult, against identity and age details the Fiduciary already reliably holds, or against identity and age details or a virtual token issued by an entity entrusted by law or the Government (for example, through DigiLocker).
• Common approaches include a single-use link or one-time password sent to the parent's own verified email or phone, and government-backed age or identity tokens (such as DigiLocker) that confirm the parent is an adult without the Fiduciary receiving or storing the underlying document.
• The Rule does not require the Fiduciary to collect or keep a copy of the parent's identity document, and keeping one adds personal data the purpose does not need.
• Keep a record of how and when the parent's consent was obtained, with the child's consent record.

Penalty if you get this wrong

Tied to §9 — up to ₹200 crore.

How ProtectComply solves it

Consent Management — children's flow

• A child's consent is held until the parent/guardian approves it from a single-use emailed link
• No guardian identity documents are collected or stored
• The approval or decline is recorded with the child's consent record
• Renewal of consent when the child turns 18