People's rights

Section 9(1) requires a Data Fiduciary, before processing any personal data of a child, to obtain the "verifiable consent" of the parent, in the manner prescribed. The Explanation to Section 9(1) makes "consent of the parent" include the consent of a lawful guardian where applicable. Module 1 covered who counts as a child under the Act.

Two prohibitions sit beside consent and apply even when the parent agrees. Section 9(2) forbids processing that is "likely to cause any detrimental effect on the well-being of a child". Section 9(3) forbids tracking or behavioural monitoring of children, and targeted advertising directed at children.

Rule 10 prescribes how verifiable consent works. Under Rule 10(1), the Data Fiduciary must adopt appropriate technical and organisational measures to ensure the parent's verifiable consent is obtained before processing, and must observe due diligence to check that the individual identifying herself as the parent is an adult who is identifiable if required under Indian law. It checks this by reference to either reliable identity and age details it already holds (Rule 10(1)(a)), or identity and age details voluntarily provided by the individual or through a virtual token mapped to such details, issued by an authorised entity (Rule 10(1)(b)). An "adult" is an individual who has completed eighteen years (Rule 10(2)(a)). Authorised entities include those entrusted by law or by government with issuing such details, and details verified by a Digital Locker service provider count (Rule 10(2)(b)).

The four illustrations to Rule 10, whoever starts the sign-up, turn on one fact. If the parent is already a registered user who has given her identity and age details, the Data Fiduciary checks that it holds reliable details and that she is an identifiable adult. If she is not, it checks by reference to details issued by an entity entrusted by law or the Government, or a token mapped to them; she may use a Digital Locker service provider to share them.

Rule 10(1) describes the check by reference to reliable identity and age details the Data Fiduciary holds, or details provided voluntarily by the individual or through a virtual token issued by an authorised entity. Rule 10 applies from 13 May 2027.

Section 9(1) also covers a person with disability who has a lawful guardian. Before processing her personal data, the Data Fiduciary must obtain the verifiable consent of that lawful guardian, in the manner prescribed.

Rule 11 prescribes the check. When an individual identifies herself as the lawful guardian of a person with disability, the Data Fiduciary must observe due diligence to verify that the guardian was appointed by a court of law, by a designated authority, or by a local level committee, under the law applicable to guardianship (Rule 11(1)).

Rule 11(2) explains who is meant. A "person with disability" means an individual with a long-term physical, mental, intellectual or sensory impairment which, in interaction with barriers, hinders her full and effective participation in society, and who, despite adequate and appropriate support, is unable to take legally binding decisions. It also includes an individual with autism, cerebral palsy, mental retardation (the Rule's term), or a combination of two or more of these, including severe multiple disability, who despite such support is unable to take legally binding decisions (Rule 11(2)(d)).

The law applicable to guardianship depends on which description fits. For the first group it is the Rights of Persons with Disabilities Act, 2016 and its rules; for the second it is the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999 and its rules (Rule 11(2)(b)). The designated authority and the local level committee are bodies set up under those two Acts (Rule 11(2)(a) and 11(2)(c)).

Two practical points. First, Rule 11 is about verifying the appointment, not about assessing the person's disability yourself; the check is whether a court, designated authority or local level committee appointed this guardian. Second, the prohibitions in Section 9(2) and 9(3) speak of children; for a person with disability, Section 9 turns on the guardian's verifiable consent. Rule 11 applies from 13 May 2027.

Section 9(4) allows the Rules to lift Section 9(1) and 9(3), consent and the tracking and advertising ban, for classes of Data Fiduciaries or purposes, subject to conditions. Rule 12 does this through the two Parts of the Fourth Schedule. The exemption never lifts Section 9(2): processing likely to harm a child's well-being stays forbidden for everyone.

Part A of the Fourth Schedule names classes of Data Fiduciaries (Rule 12(1)), each with a condition:

• a clinical establishment, mental health establishment or healthcare professional, restricted to health services to the child, to the extent necessary to protect her health;
• an allied healthcare professional, restricted to supporting a treatment and referral plan such a professional recommended for the child;
• an educational institution, restricted to tracking and behavioural monitoring for its educational activities or the safety of its enrolled children;
• an individual caring for infants and children in a crèche or day care centre, restricted to tracking and monitoring for their safety;
• a transport provider engaged by a school, crèche or centre, restricted to tracking the children's location for safety while travelling to and from it.

Part B names purposes (Rule 12(2)): exercising a power or duty under Indian law in the interests of a child; providing a subsidy, benefit, service, certificate, licence or permit in a child's interests; creating a user account limited to communication by email; determining a child's real-time location for her safety; keeping harmful information, services or advertisements from reaching her; and confirming that a Data Principal is not a child, including due diligence under Rule 10applies from 13 May 2027.

Each entry is restricted "to the extent necessary". Rule 12 and the Fourth Schedule apply from 13 May 2027.

Separately, Section 9(5) lets the Central Government notify, for a Data Fiduciary whose processing of children's data is "verifiably safe", an age above which it is exempt from all or any obligations under Section 9(1) and 9(3).

Section 11(1) gives a Data Principal the right to ask the Data Fiduciary to whom she previously gave consent, including personal data she voluntarily provided for a specified purpose (the first legitimate use in module 2), for:

• a summary of her personal data being processed and the processing activities (Section 11(1)(a));
• the identities of all other Data Fiduciaries and Data Processors with whom her data has been shared, with a description of what was shared (Section 11(1)(b));
• any other information about her personal data and its processing that is prescribed (Section 11(1)(c)).

Section 11(2) makes one exception: the sharing details need not be given where the data went to another Data Fiduciary authorised by law, on its written request, for preventing, detecting or investigating offences or cyber incidents, or for prosecution or punishment.

Section 12(1) gives her the right to correction, completion, updating and erasure of that personal data, in line with any other law's requirements. On a request, the Data Fiduciary must correct inaccurate or misleading data, complete incomplete data, and update it (Section 12(2)). On an erasure request, it must erase her personal data unless retention is necessary for the specified purpose or to comply with a law in force (Section 12(3)).

Rule 14applies from 13 May 2027 sets how requests reach you. Every Data Fiduciary must prominently publish on its website or app the means by which a Data Principal can make a request, and any particulars, such as a username or other identifier, needed to identify her under its terms of service (Rule 14(1)). She then makes the request using those means and particulars (Rule 14(2)). An "identifier" includes a customer file number, application reference number, enrolment ID, email address, mobile number or licence number (Rule 14(5)).

Sections 11 and 12 set no response deadline of their own; the ninety-day ceiling in Rule 14(3) belongs to grievances, as the next lesson explains. Rule 14 applies from 13 May 2027.

Section 13(1) gives a Data Principal the right to "readily available means of grievance redressal" from a Data Fiduciary or Consent Manager, for any act or omission in performing its obligations about her personal data or in the exercise of her rights. Section 13(2) requires a response within the prescribed period. Section 13(3) requires her to exhaust this route before approaching the Board, so a grievance system that works is also your first chance to settle a matter before it becomes a complaint.

Rule 14(3) prescribes the period. Every Data Fiduciary and Consent Manager must prominently publish on its website or app the period under its grievance redressal system for responding to grievances, which must be "a reasonable period not exceeding ninety days". It must also implement appropriate technical and organisational measures so the system actually responds within that period. Ninety days is a ceiling, not a target, and the system must be able to respond within the period you publish.

Rule 9applies from 13 May 2027 names the person behind the system. Every Data Fiduciary must prominently publish on its website or app, and mention in every response to a communication about the exercise of a Data Principal's rights, the business contact information of the Data Protection Officer, if applicable, or of a person able to answer, on the Data Fiduciary's behalf, the Data Principal's questions about the processing of her personal data.

Put together, a small business needs four things on its website or app: how to make a request and what identifier to give (Rule 14(1)), the grievance response period (Rule 14(3)), the contact person (Rule 9), and a working process behind them. Log each request and grievance with its date of receipt, since the period runs from then (Section 13(2)).

Rules 9 and 14 apply from 13 May 2027.

Section 14(1) gives a Data Principal the right to nominate any other individual who will, in the event of her death or incapacity, exercise her rights under the Act and the Rules. "Incapacity" means being unable to exercise those rights because of unsoundness of mind or infirmity of body (Section 14(2)).

Rule 14(4) sets the mechanics. She may nominate one or more individuals, in line with the Data Fiduciary's terms of service and any applicable law, using the means and furnishing the particulars the Data Fiduciary requires. So your published request route under Rule 14(1) should cover nomination too, and your records should be able to hold a nominee against a Data Principal's account. Rule 14 applies from 13 May 2027.

Section 15 then sets out duties the Data Principal owes. She must:

• comply with all applicable laws while exercising her rights (Section 15(a));
• not impersonate another person when providing her personal data for a specified purpose (Section 15(b));
• not suppress material information when providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or its instrumentalities (Section 15(c));
• not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board (Section 15(d));
• furnish only verifiably authentic information when exercising her right to correction or erasure (Section 15(e)).

These duties do not shift your obligations onto her. As module 2 explained, a Data Fiduciary stays responsible for compliance even if a Data Principal fails in her duties. Section 15(e) does mean that information she supplies for a correction or erasure should be verifiably authentic. What the Board can do about a breach of these duties is covered in module 5.