What are DPDP Act requirements for processing children's data?

Under DPDP Act Section 9, before processing digital personal data of anyone under 18, organisations must obtain verifiable parental consent. Tracking, behavioural monitoring, and targeted advertising of children are prohibited. Violations attract penalties up to Rs.200 crore.

How do I implement parental consent for DPDP Section 9?

Implement age verification at registration, route under-18 users through a parental consent flow, store consent evidence, and ensure no behavioural tracking is activated until parental consent is verified. Self-declaration alone is insufficient.

Which platforms are most at risk under DPDP Section 9?

Platforms at highest risk include: EdTech apps, gaming platforms, social media accessed by minors, e-commerce with student users, and healthcare apps used by families. If minors access your platform, Section 9 obligations apply.

Children's Data Compliance Assessment — DPDP Section 9

DPDP Children's Data Compliance — Parental Consent & Obligations

Processing data of anyone under 18? Section 9 imposes the strictest obligations under DPDP — up to ₹200 Cr penalty. Assess your compliance in 5 minutes.

⚠️ Up to ₹200 Crore penalty — the highest in the entire DPDP Act

3-step assessment Instant compliance score Section 9 aligned Full report ₹999

Step 2 — Compliance Controls

Answer Yes / No / Partial for each Section 9 control. Your honest answers give the most accurate score.

1Do you obtain verifiable parental or guardian consent before processing any data from children?

2Do you have a mechanism to verify that the consenting person is actually the parent or guardian (not the child themselves)?

3Have you prohibited behavioural monitoring or targeted advertising directed at children?

4Have you prohibited tracking children's location without verifiable parental consent?

5Have you prohibited psychological profiling of children?

6Is your privacy notice written in simple, child-understandable language (or a parent-friendly version)?

7Do you have a separate privacy policy or notice specifically for children and parents?

8Do you have a process to delete a child's data on parental request within 30 days?

9Are all employees who interact with children's data specifically trained on Section 9 obligations?

10Do you have a documented, enforceable age-verification process before collecting any personal data?

⚠️ Top 3 Compliance Violations Identified

DPDP Sections Potentially Violated

Control-by-Control Compliance Breakdown

Detailed PASS / FAIL / PARTIAL for all 10 controls with specific remediation steps for each failure...

Control 1: Verifiable Parental Consent — FAIL — Implement a 2-factor parental verification...

Control 2: Guardian Verification Mechanism — PARTIAL — Your current OTP method does not...

Control 5: Psychological Profiling Ban — FAIL — Your recommendation engine uses learning...

Verifiable Parental Consent — What Qualifies?

Under Section 9, a T&C checkbox filled by a minor is NOT valid consent. Compliant methods include: OTP sent to parent's registered mobile, parental email verification with signed declaration, video verification...

Penalty Exposure Calculation

Based on your data types and % of minor users, estimated penalty exposure: ₹150–200 Cr if enforcement action triggered. Key multipliers: biometric data (+80%), location (+60%)...

🔒

Full Report — ₹999

All 10 controls scored, remediation steps, consent templates, staff training checklist, penalty calculation

Unlock Your Full Children's Data Compliance Report

Get everything you need to comply with DPDP Section 9 — the highest-penalty section in the Act.

All 10 controls: PASS / FAIL / PARTIAL with specific remediation steps
Age verification implementation guide — what qualifies as "verifiable parental consent"
Children's Privacy Notice template (DPDP-compliant, plain language)
Parent / Guardian Consent Form template
Data deletion request process (30-day SLA implementation)
Staff training checklist specific to Section 9
Penalty exposure calculation with real DPDP section references

Get Full Report — ₹999

Secure payment via Razorpay · Report delivered instantly

Book a Free Consultation

🔒 256-bit SSL ✓ Instant delivery ✓ DPDP Act 2023 aligned ✓ Drafted by compliance experts

Payment Successful — Report Delivered!

Your full Children's Data Compliance Report has been sent to your email. You'll receive it within 2 minutes.

What is DPDP Section 9 and Why Does It Matter?

Section 9 of India's Digital Personal Data Protection Act 2023 creates the most stringent data protection obligations for any category of Data Fiduciary. Any organisation that processes personal data of children (persons under 18 years of age) or persons with disabilities must obtain verifiable consent from a parent or lawful guardian before processing their data.

Who Must Comply with Section 9?

EdTech platforms, schools, universities, gaming companies, social media platforms, e-commerce platforms with minor users, healthcare apps, OTT platforms, and any service that knowingly or unknowingly collects data from users under 18. If your platform does not verify age at sign-up, you may be assumed to be collecting children's data.

What Does "Verifiable Parental Consent" Mean Under DPDP?

A checkbox that says "I am 18 or above" filled in by the user is NOT verifiable parental consent. Acceptable methods include: OTP sent to a parent's registered mobile number, email verification from a parent's email address with a signed declaration, or government ID-based parental verification. The standard is high — and enforcement carries penalties up to ₹200 Crore.

What Are the Penalties for Section 9 Violations?

Section 9 violations can attract a penalty of up to ₹200 Crore — the highest penalty category in the entire DPDP Act. This is 4 times higher than most other DPDP violations. The Data Protection Board of India has the authority to investigate complaints and impose these fines once enforcement begins (expected May 2027).

Quick Answer