DPDP Glossary
Lawful Guardian
A parent or lawful guardian whose role is engaged for verifiable consent relating to a child or certain persons with disability.
Section 9; Rules 10 and 11
What it means
Section 9 requires verifiable consent of the parent or lawful guardian before processing a child’s personal data, subject to the Act and Rules — not informal stand-ins such as “next of kin” unless they hold that status under law. Rule 10 covers diligence that a person identifying as the parent is an adult who is identifiable if required. Rule 11 is separate: consent from a lawful guardian of a person with disability, verifying appointment by a court, designated authority, or local level committee under applicable guardianship law.
Worked example
An edtech product onboarding a 14-year-old must obtain verifiable consent from a parent or lawful guardian under Section 9 and Rule 10 — following adult-identity diligence — not treat the child’s click as enough. Separately, a care platform serving a person with disability who has a court-appointed guardian follows Rule 11: it verifies appointment under the applicable statute rather than accepting a self-declared “family guardian” label. Collapsing both into one “guardian consent” checkbox is a common mistake.
In practice
Keep Rule 10 (parent of a child) and Rule 11 (lawful guardian of a person with disability) as separate flows. Record evidence collected, how purposes are explained to the guardian, and which path applies per Data Principal. CRM labels such as “guardian” should match statutory meaning when Rule 11 applies. For the wider children’s framework, see Section 9.
Source
Section 9; Rules 10 and 11 · Official text (PDF)
Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.