Rule 10, verifiable parental consent
In short
Before processing any personal data of a child, a Data Fiduciary must adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained. It must also observe due diligence to check that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law in force in India.
01The two verification routes
| Clause | Route |
|---|---|
| 10(1)(a) | Reliable details of identity and age of the individual already available with the Data Fiduciary |
| 10(1)(b) | Details of identity and age voluntarily provided, either by the individual or through a virtual token mapped to such details issued by an authorised entity |
An adult is an individual who has completed eighteen years of age. An authorised entity is one entrusted by law or by the Central or a State Government with issuing identity and age details or a virtual token mapped to them, or a person appointed or permitted by such an entity, and the definition includes details made available and verified by a Digital Locker service provider.
02The four cases in the rule
Rule 10 works through four illustrations, and the distinction that runs through all of them is whether the parent is already a registered user whose identity and age details the Data Fiduciary holds.
| Case | Situation | What the Data Fiduciary does |
|---|---|---|
| 1 | The child declares a parent, who is a registered user with details on file | Check that it holds reliable identity and age details of the parent and that she is an identifiable adult |
| 2 | The child declares a parent, who is not a registered user | Check by reference to identity and age details issued by an entity entrusted by law or the Government, or to a virtual token mapped to them |
| 3 | The parent opens the account and is a registered user with details on file | As in case 1 |
| 4 | The parent opens the account and is not a registered user | As in case 2 |
The practical consequence is that the verification burden depends on the existing user base, not on the product. A service with verified adult users already holds the material for cases 1 and 3.
03Common questions
What counts as verifiable consent?
Rule 2 defines verifiable consent as consent as specified in rule 10 or rule 11. Rule 10 covers a parent and rule 11 covers the lawful guardian of a person with disability.
Is a government identity document required?
Where the parent is not already identifiable from reliable details held by the Data Fiduciary, the check is made by reference to identity and age details issued by an authorised entity, or a virtual token mapped to them, which may be made available through a Digital Locker service provider.
Who is a child?
An individual who has not completed eighteen years of age, under the Act.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.