DPDP Glossary

Child

An individual who has not completed eighteen years of age under the DPDP Act.

Section 2(f)

What it means

Section 2(f) fixes childhood at under eighteen. Section 9 then restricts how a child’s personal data may be processed: verifiable consent of the parent or lawful guardian is required before such processing, subject to the Act and Rules, and certain behavioural tracking and targeted advertising practices aimed at children are restricted. Age is a legal switch — not a marketing segment label.

Worked example

A gaming app that lets anyone under eighteen create an account cannot treat “I agree” from the child alone as sufficient where Section 9 applies. The Fiduciary must obtain verifiable consent from a parent or lawful guardian (Rule 10), and must not design dark patterns that nudge children into tracking or targeted ads the Act restricts.

In practice

Build age-gating and guardian consent as first-class flows, not afterthoughts. Separate child accounts from adult ones in purpose catalogues, notices and retention. See the Section 9 children’s page for the wider framework; use Lawful Guardian and Verifiable Consent for the consent actors and diligence rules.

DPDP Section 9: Children’s Personal Data →

Source

Section 2(f) · Official text (PDF)

Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.

Further reading

Lawful GuardianA parent or lawful guardian whose role is engaged for verifiable consent relating to a child or certain persons with disability.Verifiable ConsentConsent obtained in accordance with Rule 10 or Rule 11 for processing personal data of a child or of a person with disability who has a lawful guardian.

← Back to glossary