Processing children’s personal data under the DPDPA
The Digital Personal Data Protection Act, 2023 (DPDPA) defines a ‘child’ as an individual below 18 years of age. While limited exemptions have been set out in the Digital Personal Data Protection Rules, 2025 (DPDP Rules), obtaining verifiable parental consent is mandatory in all other instances before processing children’s personal data. This article explores the various legal ambiguities and operational roadblocks that organisations may face while calibrating their onboarding processes and consent management workflows for processing children’s personal data.
