Rule 12 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 12(2) exempts six purposes from sub-sections (1) and (3) of section 9 of the Act, in each case within a condition. The purposes include acting in a child's interests under law, a State benefit, creating an email-only account, real-time location for safety, keeping harmful content from a child, and confirming that a person is not a child.
Rule 12 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. Under rule 12(2), sub-sections (1) and (3) of section 9 do not apply to processing a child's personal data for the purposes in Part B of the Fourth Schedule, subject to the condition against each. Every condition limits processing to what is necessary for the purpose. Part A, which exempts classes of Data Fiduciary, is in the sibling article.
Rule 12(2) and the Act
"The provisions of sub-sections (1) and (3) of section 9 of the Act shall not be applicable to processing of personal data of a child for such purposes as are specified in Part B of Fourth Schedule, subject to such conditions as are specified in the said Part."
Section 9(1) is verifiable parental consent and section 9(3) is the bar on detrimental processing, tracking, behavioural monitoring and targeted advertising directed at children. See Section 9: verifiable parental consent, Section 9: no tracking or targeted advertising to children and Section 9: exemptions for children's processing. Where Part A exempts classes of Data Fiduciary, Part B exempts purposes, whoever the Data Fiduciary is. Part A is in our article on clinical, educational and creche classes.
Rule 1(4) places rule 12 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The Fourth Schedule follows rule 12. See rules 1 and 2.
Product teams building for children, from learning apps to family-safety tools, often need a legal consultation to see which purposes in Part B they can rely on.
Part B: six purposes
| S. no. | Purpose | Condition |
|---|---|---|
| 1 | For the exercise of any power, performance of any function or discharge of any duties in the interests of a child, under any law for the time being in force in India | Processing is restricted to the extent necessary for such exercise, performance or discharge |
| 2 | For providing or issuing of any subsidy, benefit, service, certificate, licence or permit, by whatever name called, under law or policy or using public funds, in the interests of a child, under clause (b) of section 7 of the Act | Processing is restricted to the extent necessary for such provision or issuance |
| 3 | For the creation of a user account for communicating by email | Processing is restricted to the extent necessary for creating such user account, the use of which is limited to communication by email |
| 4 | For the determination of real-time location of a child | Processing is restricted to the tracking of real-time location of such child, in the interest of her safety and protection or security |
| 5 | For ensuring that any information, service or advertisement likely to cause any detrimental effect on the well-being of a child is not accessible to her | Processing is restricted to the extent necessary to ensure that such information, service or advertisement is not accessible to the child |
| 6 | For confirmation by the Data Fiduciary that the Data Principal is not a child and observance of due diligence under rule 10 | Processing is restricted to the extent necessary for such confirmation or observance |
Items 1 and 2: law, policy and public funds
Item 1 covers the exercise of a power, performance of a function or discharge of duties "in the interests of a child, under any law for the time being in force in India". It is not limited to one kind of body. Item 2 covers a subsidy, benefit, service, certificate, licence or permit "under law or policy or using public funds, in the interests of a child, under clause (b) of section 7 of the Act". Those three phrases are defined in rule 5(2); see rule 5. Rule 5(2) says its definitions apply "in this rule and the Second Schedule"; the Fourth Schedule does not repeat them, and the Rules do not say whether they carry over here.
Item 3: an email-only account
The purpose is "creation of a user account for communicating by email". The condition is double: processing is limited to what is necessary to create the account, and the account's use "is limited to communication by email". A child's email account, created on that basis, can serve for email and nothing wider. If the same account is later used to log in to a game or social service, that use falls outside the condition. "User account" has the meaning in rule 2(1)(c).
Item 4: real-time location
"For the determination of real-time location of a child", with processing "restricted to the tracking of real-time location of such child, in the interest of her safety and protection or security". A family-safety app that lets a parent see where a child is, to keep her safe, matches this item. Storing a history of locations to analyse her habits does not appear in the condition; the text restricts processing to the tracking of real-time location.
Item 5: keeping harmful content away
The purpose is "ensuring that any information, service or advertisement likely to cause any detrimental effect on the well-being of a child is not accessible to her". The Data Fiduciary may process data to the extent necessary to keep such material from the child, for example to apply a filter. "Advertisement" has the same meaning as in the Consumer Protection Act, 2019 (35 of 2019) under the Note; the Act is not described here. For context see e-commerce under the Consumer Protection Act.
Drafting slip: two clauses in the Note are lettered (a): "advertisement" and "allied healthcare professional". The lettering runs (a), (a), (b) to (f).
Item 6: confirming that the person is not a child
"For confirmation by the Data Fiduciary that the Data Principal is not a child and observance of due diligence under rule 10." This lets a Data Fiduciary process the data needed to check age, within what is necessary. It also covers the due diligence about a parent that rule 10 requires; see rule 10. Without this item, an age check would itself be processing a possible child's data.
Example
KidSafe (invented) is a family app. A parent installs it on her daughter's phone. Under item 4 KidSafe may process the daughter's real-time location in the interest of her safety. It may not use the location trail for advertising, because the condition restricts processing to tracking real-time location for safety. When the daughter signs up for a child email account through KidSafe, item 3 covers creating that account only for email. The Rules contain no Illustration for rule 12; the example is ours.
What Part B does not do
It does not remove other obligations under the Act. It does not name penalties; see the Schedule to the Act. And it works alongside Part A: the two parts are independent routes to an exemption. For general reading written before the Rules, see children's data protection under section 9.
Need help applying Part B?
The exemptions are narrow: each condition is a limit. Speak to our legal team about checking each data flow in a child-facing product against the six items.
Key takeaways
- Rule 12 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- Part B lists six purposes exempt from section 9(1) and (3).
- Every condition restricts processing to what is necessary for the purpose.
- An email-only account, real-time location for safety, keeping harmful content away and confirming that a person is not a child are among the purposes.
- "Advertisement" has the meaning in the Consumer Protection Act, 2019.
- Later amendments and notifications should be checked.
Read next
- Rule 12, Part A: exempt classes
- Rule 10: verifiable consent of a parent
- Section 9 of the DPDP Act: no tracking or targeted advertising to children
- Children's data protection under section 9
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.