Rule 10: Verifiable Consent for Children and Persons with Disabilities
Rule 10 introduces additional safeguards for the protection of children and persons with disabilities who may not be in a position to fully understand the implications of sharing their personal data. To ensure fairness, the law requires that their data can only be processed with verifiable consent from a parent or a lawful guardian.
Under this rule:
- Any organization processing the personal data of a child must first obtain verifiable parental consent before collecting or using the data.
- For persons with disabilities, consent must be obtained from a lawful guardian who is authorized to act on their behalf.
- The method of obtaining consent must be reliable and capable of proving that it was indeed given by the parent or guardian. This may include digital authentication, official ID verification, or other approved mechanisms.
Consent for children and persons with disabilities must always be verifiable. Simple checkboxes or self-declarations are not sufficient — proof of parental or guardian authorization is mandatory.
Example Scenarios
A gaming platform like ABC PlayWorld wants to allow children under 18 to create accounts. It must design a system where the parent of a child, say Krishna (aged 14), gives consent — possibly through an OTP sent to the parent’s registered mobile number linked with Aadhaar.
A health insurance company handling claims for a person with a disability like Govind must confirm that the consent is granted by his lawful guardian (e.g., his father or legal caretaker) before processing his health data.
A social media platform cannot simply allow a 13-year-old to sign up by clicking “I Agree.” It must verify that a parent has genuinely approved the account creation.
The purpose of Rule 10 is to prevent exploitation of vulnerable individuals. Children may not understand how their photos, location, or browsing habits could be misused. Similarly, persons with disabilities may not always be able to safeguard their rights without assistance. By requiring verifiable consent, the law ensures that these groups remain protected in India’s fast-growing digital ecosystem.