Children's data under DPDP: verifiable parental consent for NGOs
Under the DPDP Act, anyone under 18 is a child, and before you process a child’s personal data you need verifiable consent from a parent or lawful guardian. Rule 10 of the DPDP Rules, 2025, which applies from 13 May 2027, says what “verifiable” means: you must check that the person consenting is an identifiable adult. For education, child-protection and youth nonprofits this is usually the heaviest item on our DPDP Rules 2025 compliance checklist for NGOs (item P3).
The three rules for children’s data
Section 9 of the Act sets three duties:
- Verifiable parental consent before processing (Section 9(1)).
- No processing likely to harm a child’s well-being (Section 9(2)).
- No tracking, behavioural monitoring or targeted advertising directed at children (Section 9(3)).
Breaking these can attract a penalty of up to ₹200 crore. The third duty catches nonprofits off guard: learning apps tracking individual usage, “at-risk” flags built from attendance patterns and ads aimed at teenagers all need a second look.
What counts as “verifiable” (Rule 10)
Rule 10 gives you three ways to check that the parent is an identifiable adult (rule text):
| Method | What it looks like in a nonprofit | Works offline? |
|---|---|---|
| (a) Reliable identity and age details you already hold | The mother is already enrolled in your self-help group with verified details | Yes |
| (b)(i) Identity and age details the parent provides | Field worker checks a government ID at enrolment and records that the check happened | Yes |
| (b)(ii) A virtual token from an authorised entity, such as DigiLocker | Parent shares a DigiLocker token through your app | No, needs connectivity |
Two points that surprise people. The Rules don’t require you to verify that the adult is actually the child’s parent, only that they are an identifiable adult; your own safeguarding process may still want to. And checking an ID doesn’t mean keeping a copy. Record the document type, the date, and who checked it. Storing photos of Aadhaar cards creates the very risk you are trying to remove.
Does the Fourth Schedule exempt us?
Probably not, though it is worth checking. Rule 12 and the Fourth Schedule relax Sections 9(1) and 9(3) in narrow cases:
- Part A (who you are): clinical and mental health establishments and healthcare professionals (for health services); allied healthcare professionals; educational institutions (tracking and behavioural monitoring for educational activities or safety); crèches and day-care centres; and transport for children of those institutions.
- Part B (what you’re doing): processing under a law in the child’s interest; providing a subsidy, benefit or service in the child’s interest under Section 7(b); creating an email-only account; blocking harmful content; and confirming someone is not a child.
“NGO” and “child welfare organisation” are not on the list. If your nonprofit runs a registered school, the educational institution entry may cover monitoring for educational or safety purposes, and nothing beyond that. If you deliver a government scheme for children, Part B may apply to that processing. Get a lawyer to confirm either.
Fiduciary or processor: who collects the consent?
Many education nonprofits work on data that a government school already collects. If the school or department decides why and how the data is processed and you act on its instructions, you’re likely a Data Processor, and the consent duty sits with the school as the fiduciary. You still need a written agreement setting out your role and safeguards. If you also use that data for your own purposes, such as your impact report or a funder dashboard, you become a fiduciary for that use, and the consent duty comes back to you.
Worked example: an after-school programme with 40 centres
Illustrative scenario. A nonprofit runs after-school learning centres for about 1,200 children aged 8–14 across 40 villages. Facilitators enrol children at the start of the year. Connectivity is patchy.
Step 1: Minimise. The enrolment form drops fields nobody used: the child’s Aadhaar number, caste and the father’s occupation. It keeps name, age, school, class and a parent’s phone number.
Step 2: Notice. The facilitator reads a short script to the parent in the local language (see our plain-language consent notice samples) and hands over a card with a helpline number.
Step 3: Verify the adult. Where the parent is already in the nonprofit’s records with verified details, method (a) applies. Otherwise the facilitator views a government ID, and the app records “ID type: voter ID, checked by F-217, 12 June 2027”. No image is stored.
Step 4: Record consent. Parent’s consent (thumbprint on paper, or OTP to their phone, captured offline and synced later), notice version, date and facilitator ID go into the child’s record in the MIS.
Step 5: Separate the extras. Photo-and-story consent for the annual report is a separate, optional step, asked later in the year.
Step 6: Check the monitoring. The “at-risk learner” flag on the dashboard is reviewed against Section 9(3) with the lawyer. The organisation keeps it as an internal teaching aid and stops using it for anything else.
Whether an OTP to the parent’s phone, on top of the ID check, is enough evidence is a judgement for your lawyer. The point is that every step leaves a record.
Persons with disabilities
Rule 11 applies a similar approach to adults with disabilities who cannot make decisions for themselves: consent comes from a lawful guardian, and you check that a court, designated authority or local-level committee appointed them. Disability-focused nonprofits should treat this as item P3 as well.
Building it into your systems
Consent in a paper register can’t follow the child through your case management or MIS records. Put the consent fields in the child’s record. If a breach ever involves children’s data, follow our 72-hour breach response plan.
Next step
Book your ZolaShield assessment → It maps where children’s data enters your organisation, scores your consent process, and gives you a 180-day plan in two weeks.