Chapter 1 – Preliminary (DPDP Act 2023)
Chapter 2 – Obligations of Data Fiduciary
Chapter 3 – Rights and Duties of Data Principal
Chapter 4 – Special Provisions
Chapter 5 – Data Protection Board of India
Chapter 6 – Powers & Procedures of the Board
Chapter 7 – Appeals & Alternate Dispute Resolution
Chapter 8 – Penalties & Adjudication
Chapter 9 – Miscellaneous
Schedule – DPDP Act 2023
Rule 1 – DPDP Draft Rule 1
Rule 2 – DPDP Draft Rule 2
Rule 3 – DPDP Draft Rule 3
Rule 4 – DPDP Draft Rule 4
Rule 5 – DPDP Draft Rule 5
Rule 6 – DPDP Draft Rule 6
Rule 7 – DPDP Draft Rule 7
Rule 8 – DPDP Draft Rule 8
Rule 9 – DPDP Draft Rule 9
Rule 10 – DPDP Draft Rule 10
Rule 11 – DPDP Draft Rule 11
Rule 12 – DPDP Draft Rule 12
Rule 13 – DPDP Draft Rule 13
Rule 14 – DPDP Draft Rule 14
Rule 15 – DPDP Draft Rule 15
Rule 16 – DPDP Draft Rule 16
Rule 17 – DPDP Draft Rule 17
Rule 18 – DPDP Draft Rule 18
Rule 19 – DPDP Draft Rule 19
Rule 20 – DPDP Draft Rule 20
Rule 21 – DPDP Draft Rule 21
Rule 22 – DPDP Draft Rule 22
Conditions for Registration of Consent Manager
Schedule Second – DPDP Draft Rules
Schedule Third – DPDP Draft Rules
Schedule Fourth – DPDP Draft Rules
Schedule Fifth – DPDP Draft Rules
Schedule Sixth – DPDP Draft Rules
Schedule Seventh – DPDP Draft Rules
DPDP Final Rule 1
DPDP Final Rule 2
DPDP Final Rule 3
DPDP Final Rule 4
DPDP Final Rule 5
DPDP Final Rule 6
DPDP Final Rule 7
DPDP Final Rule 8
DPDP Final Rule 9
DPDP Final Rule 10
DPDP Final Rule 11
DPDP Final Rule 12
DPDP Final Rule 13
DPDP Final Rule 14
DPDP Final Rule 15
DPDP Final Rule 16
DPDP Final Rule 17
DPDP Final Rule 18
DPDP Final Rule 19
DPDP Final Rule 20
DPDP Final Rule 21
DPDP Final Rule 22
DPDP Final Rule 23
First Schedule – DPDP Final Rules
Second Schedule – DPDP Final Rules
Third Schedule – DPDP Final Rules
Fourth Schedule – DPDP Final Rules
Fifth Schedule – DPDP Final Rules
Sixth Schedule – DPDP Final Rules
Seventh Schedule – DPDP Final Rules
Rule - 10
(1) A Data Fiduciary shall adopt
appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained
before the processing of any personal data of a child and shall observe due diligence, for checking that the
individual identifying herself as the parent is an adult who is identifiable if required in connection with
compliance with any law for the time being in force in India, by reference to—
(a)reliable details of identity and age of the individual available with the Data Fiduciary; or
(b)details of identity and age, voluntarily provided —
(i)by the individual; or
(ii) through a virtual token mapped to such details, which is issued by an authorised entity
(2)In this rule, the expression—
(a)an entity entrusted by law or by the Central Government or by the State Government with
the issuance of details of the identity and age or a virtual token mapped to such details; or
(b)an entity entrusted by law or by the Central Government or by the State Government with
the issuance of details of the identity and age or a virtual token mapped to such details; or
(c)“Digital Locker service provider” shall mean such intermediary, including a body corporate or an
agency of the appropriate Government, as may be notified by the Central Government, in
accordance with the rules made in this regard under the Information Technology Act, 2000 (21 of
2000)
Illustration
C is a child, P is a parent, and DF is a Data Fiduciary. A user account of C is sought to be created
on the online platform of DF, by processing the personal data of C.
Case 1: C informs DF that she is a child and declares P as her parent. DF shall enable P to identify
herself through its website, app or other appropriate means. P identifies herself as the parent and informs
DF that she is a registered user on DF’s platform and has previously made available her identity and age
details to DF. Before processing C’s personal data for the creation of her user account, DF shall check to
confirm that it holds reliable identity and age details of P and that P is an identifiable adult.
Case 2:C informs DF that she is a child and declares P as her parent. DF shall enable P to identify
herself through its website, app or other appropriate means. P identifies herself as the parent and informs
DF that she herself is not a registered user on DF’s platform. Before processing C’s personal data for the
creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted
by law or the Government with maintenance of the said details or to a virtual token mapped to the identity
and age, check that P is an identifiable adult. P may voluntarily make such details available using the
services of a Digital Locker service provider
Case 3: P is opening an account for C and identifies herself as C’s parent and informs DF that she
is a registered user on DF’s platform and has previously made available her identity and age details to DF.
Before processing C’s personal data for the creation of her user account, DF shall check to confirm that it
holds reliable identity and age details of P and that P is an identifiable adult.
Case 4: P is opening an account for C and identifies herself as C’s parent and informs DF that she
herself is not a registered user on DF’s platform. Before processing C’s personal data for the creation of her
user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the
Government with maintenance of the said details or to a virtual token mapped to the identity and age, check
that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital
Locker service provider.