Section 9 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 9(1) requires a Data Fiduciary to obtain verifiable consent of the parent or lawful guardian before processing any personal data of a child, or of a person with disability who has a lawful guardian. The manner is left to the rules. If your service may be used by under-18s, a legal consultation can help you work out where this duty bites.
Before processing any personal data of a child (an individual who has not completed eighteen years) or of a person with disability who has a lawful guardian, the Data Fiduciary must obtain verifiable consent of the parent or the lawful guardian, in the manner prescribed (section 9(1)). The Act's own Explanation says "consent of the parent" includes consent of the lawful guardian. Breach of section 9 attracts a penalty that may extend to Rs 200 crore (Schedule, item 3).
Section 9(1) at a glance
| Element | What the text says |
|---|---|
| Who is protected | A child; a person with disability who has a lawful guardian |
| When | "Before processing any personal data" |
| What is required | Verifiable consent of the parent or lawful guardian |
| How | "In such manner as may be prescribed" |
| Explanation | "Consent of the parent" includes the consent of lawful guardian, wherever applicable |
| Penalty | Up to Rs 200 crore (Schedule, item 3) |
Who is a child
Section 2(f) defines a child as "an individual who has not completed the age of eighteen years". The Act sets one age line, and it applies to this section. There is no separate rule for older teenagers in the text of section 9(1). Different arrangements for certain classes or purposes come only through section 9(4) and (5), which are covered in the article on exemptions. The DPDP Rules, 2025 (notified November 2025) prescribe detail and different provisions commence on different dates; check the Rules for how that operates.
Section 2(j) adds that, for a Data Principal who is a child, the expression includes the parents or lawful guardian of the child; for a person with disability, it includes her lawful guardian acting on her behalf. So the parent or guardian can act as the Data Principal for rights under Chapter III as well. See definitions of Data Principal.
"Before processing any personal data"
Two words carry weight: "before" and "any".
- Before. Consent must come first. Collecting the child's data and asking the parent afterwards does not meet the text. Since "processing" under section 2(x) starts with collection, the consent has to be in place at collection.
- Any. There is no threshold by type or amount of data. A name and email address for an account is personal data of a child.
This also means a business must have some way of knowing that a user is a child. The Act does not say how a fiduciary should find out a user's age or what counts as sufficient, and leaves the manner to the rules. What the Act does say is that processing without the consent is a breach, so a business that knowingly or carelessly serves children with no route for parental consent takes the risk.
"Verifiable"
The Act uses the word "verifiable", not just "consent". Section 6(1) already requires consent to be "free, specific, informed, unconditional and unambiguous with a clear affirmative action". Section 9(1) adds that the consent of the parent must be verifiable. The text does not define the word or list methods. Read in context, it means the fiduciary should be able to show that the person consenting is in fact the parent or lawful guardian and that the consent was given. The manner "as may be prescribed" is in the Rules. Do not copy a method from a foreign law or a blog post; check the Rules.
Notice and consent still apply. The parent should receive the notice under section 5, and section 6(10) puts the burden of proving that notice was given and consent obtained in accordance with the Act on the Data Fiduciary. See burden of proof.
Persons with disability and lawful guardians
The section extends beyond children: "a person with disability who has a lawful guardian". Section 9(1) does not define disability or lawful guardian in this Act, so those meanings come from other law, and the Act does not cite which. The key condition is that the person has a lawful guardian; a person with disability who has none is outside the wording of this sub-section. Take advice before applying it to a particular case.
Which processing is caught
Section 9(1) applies to processing by a Data Fiduciary of a child's data. Section 7's certain legitimate uses are listed in a separate section, and the text of section 7 has its own conditions. Section 9(1) does not itself list exceptions; the exemptions for classes or purposes are in section 9(4) and (5) by prescription and notification. Do not assume a legitimate use under section 7 displaces section 9 unless the text of the Act supports it for your case. Apply both sections together and seek advice where they seem to pull in different directions.
Who it binds
The duty is on the Data Fiduciary. A Data Processor working for it does not carry it directly, but the fiduciary is responsible for processing on its behalf under section 8(1). Section 3 decides whether a foreign service is caught. See section 3.
Consequence of breach
Item 3 of the Schedule: breach in observance of additional obligations in relation to children under section 9 may extend to two hundred crore rupees. The Board can impose this only after an inquiry and hearing and on finding that the breach is significant (section 33(1)); section 33(2) factors, including the type and nature of the data affected, apply. Children's data is likely to be weighed seriously, though the Act does not say so in terms. See penalties and the overview post on children's data protection.
Practical examples
Example 1: learning app. An app lets a student sign up with her own email. The student is under eighteen. The app needs the parent's verifiable consent before it collects the email and name.
Example 2: parent consent obtained after sign-up. The app collects data at sign-up and then sends a message to the parent. The text asks for consent before processing, so collection without prior parental consent is a problem.
Example 3: guardian of an adult with disability. An adult with a disability has a lawful guardian. A service wishing to process her data needs the guardian's verifiable consent under section 9(1).
Common mistakes
- Assuming only children under a low age are covered; the Act says eighteen.
- Using a tick-box "I am over 18" as the only check, with no thought to verification.
- Forgetting persons with disability who have lawful guardians.
- Collecting first and seeking consent later.
Need help with children's data?
If your product is used by students, young customers or families, it helps to decide early how you will know a user's age and obtain parental consent. Our legal consultation team can help you map the flows and read the Rules that apply.
Key takeaways
- A child is anyone under eighteen years (section 2(f)).
- Verifiable consent of the parent or lawful guardian is required before processing any data of a child.
- The same applies to a person with disability who has a lawful guardian.
- The manner of verification is for the Rules.
- Penalty for breach of section 9 may extend to Rs 200 crore.
Read next
- Section 9 of the DPDP Act, 2023: no tracking or targeted advertising to children
- Section 9 of the DPDP Act, 2023: exemptions for children's processing
- Section 6 of the DPDP Act, 2023: what valid consent requires
- Children's data protection under section 9
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.