← Back to DPDP primer

DPDP Rule 9 (2025)

Verifiable Parental Consent

Paraphrased legal text

The Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before any processing of a child's personal data, including verification by reference to a digitally-signed identity or other reliable means.

What this means in plain English

  • Aadhaar-based or document-based verification of the parent is the safe default.
  • Self-declaration alone is not enough.
  • Maintain a verification artefact alongside the consent record.

Penalty if you get this wrong

Tied to §9 — up to ₹200 crore.

How ProtectComply solves it

Consent Management — children's flow

  • Pluggable verification (Aadhaar, document, prescribed identity proofs)
  • Verification artefact stored as evidence with the consent record
  • Re-verification reminders at adulthood transition
See the module →

Related

DPDP §9 — Processing of Children's DataDPDP §5 — Notice & Free Consent