AI Learning Companion

Have a Question About the DPDP Act?

Ask any question about India's Digital Personal Data Protection Act, statutory provisions, compliance requirements, or individual rights to get immediate citations and practical guidance.

What are the rules for processing children's personal data?

Section 9 of the Act

Under Section 9, a child is defined as any individual under 18 years of age. Before processing personal data of a child, a Data Fiduciary must obtain verifiable consent of the parent or lawful guardian. Additionally, Data Fiduciaries are strictly prohibited from: (1) Processing personal data that is likely to cause any detrimental effect on the well-being of a child; (2) Undertaking tracking or behavioral monitoring of children; and (3) Directing targeted advertising towards children. Breach of Section 9 carries penalties up to ₹200 Crore.

What are the statutory penalties for non-compliance?

Section 33 & The Schedule

The Data Protection Board of India has statutory powers to levy substantial financial penalties: Up to ₹250 Crore for failure to implement reasonable security safeguards resulting in a data breach; Up to ₹200 Crore for failure to notify the Board and affected users of a breach; Up to ₹200 Crore for non-compliance with child data obligations; Up to ₹150 Crore for SDF violations; and Up to ₹50 Crore for general non-compliance.

← Back to DPDPActs Hub Explore Compliance Resources →
Appointment