Lawful Guardian Under DPDP

Section 9 centres on processing personal data of a child and requires verifiable consent of the parent or lawful guardian before such processing, subject to the Act and Rules. The Act uses “parent or lawful guardian” as the statutory actors for that consent — not informal stand-ins such as “next of kin” unless they hold that status under applicable law.

Rule 10 elaborates verifiable consent for a child’s personal data and focuses on due diligence that the individual identifying as the parent is an adult who is identifiable if required. For the broader children’s framework, see DPDP Section 9: Children’s Personal Data.

Rule 11 addresses a distinct situation: obtaining verifiable consent from an individual who identifies as the lawful guardian of a person with disability. The Data Fiduciary must observe due diligence to verify that such guardian is appointed by a court of law, or by a designated authority, or by a local level committee, under the law applicable to guardianship. Rule 11 defines key terms by reference to the Rights of Persons with Disabilities Act, 2016 and the National Trust Act, 1999 (and rules thereunder), including “designated authority,” “local level committee,” and the categories of “person with disability” for this Rule.

Separate parent-of-child flows (Rule 10) from lawful-guardian-of-person-with-disability flows (Rule 11). They share the idea of verifiable consent but impose different due-diligence checks. For Rule 11, process design should ask for and record evidence of guardianship appointment under the applicable statute — court order, designated authority, or local level committee — rather than relying only on a self-declared relationship.

Teams handling accounts, care products, accessibility services or assisted onboarding should document who may act, what evidence is collected, how long it is retained, and how consent purposes are described to the guardian. Where both a child and a person with disability context could arise, map the correct Rule path per Data Principal.

Product or CRM labels such as “guardian” should align with statutory meaning. Marketing language that treats any adult relative as a lawful guardian can create false confidence if appointment under applicable guardianship law has not been verified when Rule 11 applies.