A 16-year-old signs up for your app. A parent ticks “I agree.”
Before treating that as a completed process, ask: how was the parent verified, what data does the app collect, and which tracking tools start running?
Preparing for the DPDP Rules for Children’s Data means checking the entire journey from registration to third-party processing.
This guide helps product, IT, marketing and compliance teams identify what to prepare and where to start.
What are the key requirements?
Under the DPDP Act, a child is someone below 18 years of age. Section 9 generally requires verifiable parental consent before processing children’s personal data, prohibits processing likely to harm their well-being, and restricts tracking, behavioural monitoring and targeted advertising directed at children.
Applicable exemptions must be assessed separately. Parental consent does not override the prohibition on harmful processing.
Timing: As of October 2026, Section 9 and Rules 10 and 12 are in the notified 18-month commencement phase. Using the Gazette’s printed date of 13 November 2025, their scheduled commencement is 13 May 2027.
These are forthcoming requirements. Use the preparation period to test your processes.
Could your business process children’s data?
Review more than the audience named in your marketing plan. Check whether children can register, upload information, make purchases or appear in records submitted by adults.
A practical review could include student profiles, gaming accounts, appointment records and teenage shoppers. Map where the information enters your business and which systems receive it.
Start with one question: Can we identify the journeys that need a child-specific process?
Age assurance and parental consent are different
Process | Question it answers |
Age assurance | Is the person using the service a child? |
Parental consent verification | Has the required consent been obtained, and is the person identifying themselves as the parent an identifiable adult? |
Rule 10 requires due diligence using reliable identity and age details already held, or voluntarily provided details, including through a virtual token mapped to them and issued by an authorised entity. Qualifying Digital Locker arrangements are recognised.
DigiLocker is an available route, not mandatory for every business. The Rules do not prescribe one universal age-check method for every visitor.
Choose a verification approach consistent with Rule 10 and proportionate to your service. Avoid treating an email address or existing account alone as proof of the required checks.
What should your team prepare?
1. Review the signup journey
List what happens before and after a user submits their age or an adult gives consent.
Check when account creation, analytics, advertising tools and other processing start. Design the journey so processing requiring parental consent waits for completion of the applicable process.
Make notices understandable and connect consent choices to the purposes they cover.
2. Review tracking tools and integrations
Build an inventory of analytics SDKs, advertising pixels, personalisation features and vendor integrations.
For each one, ask:
What information does it collect?
Does it start automatically?
Can its behaviour be changed for child users?
Which provider receives the information?
Review actual settings and data flows. A tool’s name does not explain everything it does.
3. Assess exemptions for the specific activity
Rule 12 and the Fourth Schedule provide conditional exemptions for specified organisations and purposes. They concern Section 9(1) and 9(3), not Section 9(2)’s well-being safeguard.
An educational or healthcare context is not a blanket exemption. Check the precise class, purpose and conditions before relying on one.
Record which activity an exemption covers and who checks that its conditions remain satisfied.
4. Test the process across teams
Use a realistic test account and follow the journey through your application and relevant providers.
Check consent status, configured tracking, access permissions, withdrawal handling and retention decisions. Give each gap an owner.
Keep proportionate evidence of the test and decisions. A notice version, consent timestamp and verification outcome can help; these are suggested evidence fields, not a register format expressly prescribed by Rule 10.
Who should own the work?
Team | Suggested responsibility |
Product and engineering | Age-aware onboarding and processing controls |
Privacy or compliance | Requirement assessment, consent design and exemption review |
Marketing | Advertising audiences, pixels and campaign settings |
IT and security | Access, safeguards, system configuration and testing |
Vendor owners | Provider settings, contracts and coordinated actions |
A small team may combine roles. Assign one coordinator so changes to the product, notice and vendor settings stay connected.
This is a preparation checklist, not proof of full compliance.
Build a workable process with WhizzC
Bring your signup journey, consent screens and integration list to a readiness discussion.
Explore WhizzC’s DPDPA compliance offering, or contact the WhizzC team to discuss the gaps you need to address.
Start with one journey. Make sure every team understands how it works.
