Rule 12 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 12(1) exempts five classes of Data Fiduciary from sub-sections (1) and (3) of section 9 of the Act when they process a child's personal data, but only on the conditions printed against each class in Part A of the Fourth Schedule. Those classes are clinical and healthcare providers, educational institutions, creches and child day care centres, and transport providers engaged by them.
Rule 12 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. Sub-sections (1) and (3) of section 9 do not apply to a class in Part A, subject to the condition against it. Section 9(1) is verifiable parental consent; section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. Each class is exempt only to the extent of its condition. Part B (exempt purposes) is covered in the sibling article.
Rule 12(1) and the Act
Section 9 of the Act has sub-section (1) (verifiable consent of the parent or guardian) and sub-section (3) (no processing that is likely to cause detrimental effect on the well-being of a child, and no tracking, behavioural monitoring or targeted advertising directed at children). Rule 12(1) says: "The provisions of sub-sections (1) and (3) of section 9 of the Act shall not be applicable to processing of personal data of a child by such class of Data Fiduciaries as are specified in Part A of Fourth Schedule, subject to such conditions as are specified in the said Part."
The Act's text is covered in Section 9: verifiable parental consent, Section 9: no tracking or targeted advertising to children and Section 9: exemptions for children's processing. Rule 12(2) and Part B, which exempt certain purposes, are in our article on Part B.
Rule 1(4) places rule 12 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The Fourth Schedule has no commencement line of its own and follows rule 12. See rules 1 and 2.
A school, clinic or creche that is unsure whether it sits inside a class often needs a short legal consultation to read its activities against the condition.
What the exemption does and does not do
Two points before the table. First, the exemption removes only section 9(1) and (3); other duties under the Act stay. Second, it is conditional: each class has a condition in column (3), and processing outside the condition is outside the exemption. The conditions all start "Processing is restricted to", so the exemption is as wide as the condition and no wider.
Part A: the five classes
| S. no. | Class of Data Fiduciary | Condition |
|---|---|---|
| 1 | A clinical establishment, mental health establishment or healthcare professional | Processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health |
| 2 | An allied healthcare professional | Processing is restricted to supporting implementation of any healthcare treatment and referral plan recommended by such professional for the child, to the extent necessary for the protection of her health |
| 3 | An educational institution | Processing is restricted to tracking and behavioural monitoring (a) for the educational activities of such institution; or (b) in the interests of safety of children enrolled with such institution |
| 4 | An individual in whose care infants and children in a creche or child day care centre are entrusted | Processing is restricted to tracking and behavioural monitoring in the interests of safety of children entrusted in the care of such institution, creche or centre |
| 5 | A person engaged by an educational institution, creche or child care centre for transport of children enrolled with such institution, creche or centre | Processing is restricted to tracking the location of such children, in the interests of their safety, during the course of their travel to and from such institution, creche or centre |
Items 1 and 2: health
Item 1 covers a clinical establishment, a mental health establishment or a healthcare professional. The condition is "provision of health services to the child ... to the extent necessary for the protection of her health". Item 2 covers an allied healthcare professional and is narrower: "supporting implementation of any healthcare treatment and referral plan recommended by such professional for the child". For both, the limit is what is necessary for the protection of the child's health.
Example (invented): a paediatric clinic keeps a child's records and shares a referral plan with a physiotherapist. Under item 1 the clinic's processing is within the exemption to the extent necessary for her health. If the same clinic uses her records for a marketing campaign, that goes beyond the condition.
Item 3: educational institutions
The condition is limited to "tracking and behavioural monitoring" for (a) "the educational activities of such institution" or (b) "in the interests of safety of children enrolled". The words are specific: this item exempts tracking and behavioural monitoring. It does not, on its text, speak of other kinds of processing. A school's learning app that tracks a pupil's progress in lessons falls under (a); a bus-entry system that records when pupils enter the campus, for safety, falls under (b).
Item 4: creches
Drafting slip: the class is "an individual in whose care infants and children in a creche or child day care centre are entrusted" but the condition speaks of "such institution, creche or centre", which the class description does not name as an institution. It is quoted as printed. The condition allows tracking and behavioural monitoring "in the interests of safety of children entrusted in the care of such institution, creche or centre". Camera monitoring of play areas for safety is the type of activity the item has in view; this is our reading, not an example from the Rules.
Item 5: transport
The class is a person "engaged by an educational institution, creche or child care centre for transport of children enrolled with such institution, creche or centre". The condition is "tracking the location of such children, in the interests of their safety, during the course of their travel to and from such institution, creche or centre". It is limited to location tracking and to the journey. A bus operator that keeps tracking children after drop-off is outside the condition.
The Note: definitions by reference
The Note to the Fourth Schedule defines terms by reference to other laws. They are quoted, not explained:
| Term | Defined by reference to |
|---|---|
| "allied healthcare professional" | clause (d) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021) |
| "clinical establishment" | clause (c) of section 2 of the Clinical Establishments (Registration and Regulation) Act, 2010 (23 of 2010) |
| "educational institution" | "an institution of learning that imparts education, including vocational education" (the Schedule's own meaning) |
| "healthcare professional" | clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 |
| "health services" | the services required to be provided by a healthcare professional as referred to in clause (j) of section 2 of that Act |
| "mental health establishment" | clause (p) of sub-section (1) of section 2 of the Mental Healthcare Act, 2017 (10 of 2017) |
Drafting slip: two clauses of the Note are lettered (a): "advertisement" (by reference to the Consumer Protection Act, 2019) and "allied healthcare professional". The lettering therefore runs (a), (a), (b) to (f). "Advertisement" is not used in Part A; it matters for Part B and is covered in the sibling article.
For context on how these rules apply to the sector, see our post on the DPDP Act for healthcare and pharma, which predates the Rules.
Need help reading the exemption for your institution?
Whether you fall in a class, and whether a given feature stays inside the condition, are matters of fact. Speak to our legal team before you rely on the exemption in a product or school policy.
Key takeaways
- Rule 12 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- Part A exempts five classes from section 9(1) and (3) only, and only within the condition against each.
- Health classes: processing limited to health services or a treatment and referral plan, as necessary for the child's health.
- Educational institutions: tracking and behavioural monitoring for educational activities or safety.
- Creches: tracking and behavioural monitoring for safety. Transport providers: location tracking during travel to and from the institution.
- Definitions come from other Acts, quoted by reference only.
- Later amendments and notifications should be checked.
Read next
- Rule 12, Part B: exempt purposes for processing a child's data
- Rule 10: verifiable consent of a parent
- Section 9 of the DPDP Act: exemptions for children's processing
- DPDP Act for healthcare and pharma
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.