Is my child's data specially protected under DPDPA?

What the Law Says

The Digital Personal Data Protection Act, 2023 (DPDPA) introduces specific safeguards for children’s personal data, recognising their vulnerability and need for heightened protection.

The DPDPA defines a 'child' as any individual under the age of 18 years. This is broader than many global standards (e.g., GDPR’s age 16 threshold) and ensures comprehensive coverage for minors across India.

Data fiduciaries — entities that collect or process personal data — must obtain verifiable consent from the child’s parent or legal guardian before processing any personal data of a child. No processing is permitted without this consent.

The law strictly prohibits tracking children or serving targeted advertisements to them. It also bans behavioural monitoring and profiling of children for any purpose, including commercial or predictive analytics.

Violations involving children’s data attract enhanced penalties: up to ₹200 crore for failure to prevent tracking or profiling of children, and up to ₹500 crore for failure to obtain parental consent.

Statutory Text

‘child’ means a person who has not completed the age of eighteen years

— Digital Personal Data Protection Act, 2023, s. 2(7) — Definitions

Statutory Text

A data fiduciary shall not process the personal data of a child in a manner that is detrimental to the well-being of the child… or track or behaviourally monitor the child or serve targeted advertising to the child

— Digital Personal Data Protection Act, 2023, s. 16(1) — Processing of personal data of children

Statutory Text

A data fiduciary shall not process the personal data of a child without obtaining the consent of the parent or legal guardian of the child

— Digital Personal Data Protection Act, 2023, s. 16(2) — Consent requirement

Sources