Consent Docs
Open console

DPDP duties for rights and children

Each DPDP Act duty about people's rights, grievances, children and guardians, with what PIEDAP Consent does and what remains yours.

Reference9 min readFor anyone looking something up

Each duty about rights requests, grievances, children and guardians under India's DPDP Act, 2023 and DPDP Rules, 2025, with what the product does and what remains yours.

Confirm the citations

Where the product cites a section or rule in its own messages, this page uses the same citation. This is not legal advice. Confirm each citation with your counsel.

How to read the tables#

  • Duty is a short version of the section or rule beside it. Read the text itself before you rely on it.
  • A DPDP rule is an enabled region rule under the DPDP law, the preset for India.
  • You are the Data Fiduciary. The product processes consent records for you.
  • Rules 9 to 14 apply from 13 May 2027. DPDP dates lists every date.

Rights and grievance#

Duty Section or rule What the product does What remains yours
Publish how to make a rights request and what identifies the person. Rule 14(1) The hosted privacy notice and request form. The form asks for what The rights request form asks for names in Project settings, such as a customer number. Under a DPDP rule the banner links to the form. Publishing the same means in your app and privacy policy.
Give a summary of the personal data and processing, and say who it was shared with. Section 11(1); Rule 14 An access request produces a signed receipt for each record and a summary of each purpose with the data it uses. It lists every partner the data was shared with, including under consent since withdrawn. Your server can produce the same package with POST /sdk/v1/subjects/export (scope subjects:export). The summary covers what was recorded in this product. Personal data and sharing in your other systems are yours to add.
Correct, complete, update and erase. Section 12 Requests of each type are tracked with a deadline. Erasure of consent records is one action from the request, the console or POST /sdk/v1/subjects/erase (scope subjects:erase). A confirmed correction request sends subject.rectification_requested, without the identifier. Completing it records What was corrected and, if given, the SHA-256 of a document. Correcting and erasing the data in your own systems.
Redress grievances. Section 8(10), 13 A Grievance request type with a deadline, a handler from your team and a timeline of who did what. A grievance officer named in Project settings appears on the hosted pages. The DPDP Act check reports them. Resolving the grievance.
Answer the person. Section 13 The reply your team writes when closing a request appears on the person's request status page. subject_request.completed carries it as reply. Sending the reply. The product sends no email.
Store who the nominee is, and let the person change or cancel it. Section 14(1); Rule 14(4) A Nomination request is completed by recording the nominee: the name encrypted, the relationship, and the email address or phone number as a keyed hash. A new nomination replaces the one in force. Your team can cancel one from a request or from Records. It shows in the person's records and in the access export as nominations. Checking the request came from the person.
Let the nominee use the person's rights after death or incapacity. Section 14(2) A request can be made as the nominee. It can be fulfilled only once your team confirms that the registered nominee matches and records the death or incapacity, with the SHA-256 of the document checked. Checking the nominee's identity and the death or incapacity.
Answer grievances within a published period of at most 90 days. The Government's explainer describes the same period for access, correction, updating and erasure requests. Rule 14(3) Requests from India are due within the project's Response deadline, capped at 90 days, for every request type. The hosted notice publishes the period. A request is overdue as soon as its deadline passes. A subject_request.due_soon webhook is sent daily for requests due within five days or overdue. Answering in time.
Publish who answers questions, and name them in every response. Section 8(9); Rule 9 The organisation, email, phone, postal address, Data Protection Officer and grievance officer from Project settings appear on the hosted notice and the hosted request pages. They are also in every request webhook and in the access export. Appointing the people and keeping the details up to date.

A request counts as from India in any of these cases:

  • it names India or the DPDP Act
  • the person's records do
  • the project has an enabled DPDP rule

The hosted request form does not email the person. It sends a subject_request.received webhook with a confirmation link, and you send that link.

Children and guardians#

Duty Section or rule What the product does What remains yours
Find out whether the person is a child. Section 9 A form can ask "Are you 18 or older?" before the purposes. The answer is sealed with the record. A No records the person as a child and shows your page for a parent or guardian. See Age question. Choosing whether to ask. Any check of age beyond the person's own answer.
Get the verifiable consent of the parent before processing a child's data. Section 9(1); Rule 10 A server call can record consent with dataPrincipalType: "CHILD" and a guardian with a verification method. The method and a keyed hash of the reference are sealed into the record. The receipt shows the relationship, the method and the time of verification. A browser cannot record guardian consent (GUARDIAN_CONSENT_SERVER_ONLY). On a child's record, a new grant sent from a browser is stored as refused. Your page where the parent consents. The due diligence that the person consenting is an identifiable adult parent. The product records your result and the method you used; it does not verify the parent.
Do not track children, monitor their behaviour or target advertising at them. Do nothing likely to harm their well-being. Section 9(2), 9(3) For a child under the Act, purposes in five categories are stored as refused, whatever was submitted: analytics, marketing, personalisation, sale or sharing, and sensitive data. A Fourth Schedule entry on the purpose can release some of them. Marketing and sale or sharing are always refused. Putting each purpose in the right category. Not tracking children by means the product cannot see.
Use the exemptions for the classes and purposes in the Fourth Schedule within their conditions. Rule 12 A purpose can name the Fourth Schedule entry it relies on. An entry releases analytics and personalisation. It releases sensitive data only under the health and location entries. A parent's consent is not needed when every purpose granted is covered. Meeting the entry's conditions and, for Part A, belonging to the listed class.
Get the lawful guardian's verifiable consent for a person with disability. Section 9(1); Rule 11 dataPrincipalType: "PERSON_WITH_DISABILITY" requires verification: "GUARDIANSHIP_ORDER". Fourth Schedule entries do not apply to these records. Checking that the guardian was appointed by a court, a designated authority or a local level committee.
Let a parent make rights requests for the child, and a lawful guardian for the person. Section 2(j) A request can be made as a parent or a lawful guardian, on the hosted page or in the console. It can be fulfilled only once your team records the SHA-256 of the document checked, a note, who confirmed it and when. Checking the parent's or guardian's authority.
Keep the guardian's authority on each later action, not only on the consent. Rule 11 A withdrawal or erasure carried out for such a request seals actingAs into the record's history: who acted, the request reference, when authority was confirmed and the document's SHA-256. Records without it seal as before. None

Age question#

Set Ask "Are you 18 or older?" in the form's Settings. It takes effect when you publish.

Setting The banner asks
Never Nobody. This is the default.
Where the DPDP Act applies Visitors under a DPDP rule.
Everywhere Every visitor, under any rule.

The question comes before the purposes, with Yes and No of equal weight. It is not asked on a notice-only form. The wording is part of the dialog labels, in every language the runtime speaks, and can be reworded per language.

The visitor answers What happens
Yes The banner shows the purposes. The answer goes with the record.
No Everything optional is refused and recorded at once, with dataPrincipalType: "CHILD". The banner says a parent or guardian needs to give this consent and links to Page for a parent or guardian. Later, only purposes a Fourth Schedule entry covers can be switched on.

The answer is kept in the visitor's browser, so it is asked once. The record carries it as ageDeclaration, sealed like the rest of the record:

JSON
{
  "ageDeclaration": {
    "eighteenOrOver": false,
    "parentalConsentUrl": "https://www.example.in/parent-consent"
  }
}

The link is the one the published version named, which the record's form version also seals. The product records what the person said and the link they were shown. It does not check the age, and it does not verify the parent. When your page has verified a parent, your server records the parent's consent with guardian, as in the example below.

Verification methods#

Your server sends one of these in guardian.verification. The product records the method; it does not verify the guardian.

Value Rule Meaning
EXISTING_ACCOUNT Rule 10(1)(a) You already hold reliable identity and age details of the parent.
IDENTITY_DOCUMENT Rule 10(1)(b)(i) The parent provided identity and age details.
VIRTUAL_TOKEN Rule 10(1)(b)(ii) A virtual token issued by an authorised entity, which includes a Digital Locker service provider.
GUARDIANSHIP_ORDER Rule 11 The guardian was appointed by a court, a designated authority or a local level committee.

Fourth Schedule entries#

Set the entry on a purpose under Children (India, DPDP Fourth Schedule). No entry releases marketing or sale or sharing.

Entry Label in the console Releases sensitive data
A1 Clinical or mental health establishment, or healthcare professional — health services for the child Yes
A2 Allied healthcare professional — supporting the child's treatment and referral plan Yes
A3 Educational institution — its educational activities or children's safety No
A4 Crèche or day care — safety of children in care No
A5 Transport for an educational institution, crèche or child care centre — location during travel Yes
B1 Power, function or duty under Indian law, in the child's interest No
B2 State subsidy, benefit, service, certificate, licence or permit for the child (section 7(b)) No
B3 User account used only for email communication No
B4 Real-time location for the child's safety Yes
B5 Keeping harmful content away from the child No
B6 Confirming the person is not a child, or checking a parent under rule 10 No

Example#

A server records a parent's consent for a child. The parent was verified against an account you already hold.

JavaScript
await client.recordConsent({
  formKey: 'kalpa-account',
  subjectId: child.id,
  subjectType: 'USER_ID',
  countryCode: 'IN',
  decisions,
  dataPrincipalType: 'CHILD',
  guardian: {
    relationship: 'PARENT',
    verification: 'EXISTING_ACCOUNT',
    reference: parent.id,
  },
});

guardian.relationship is PARENT or LAWFUL_GUARDIAN. Record consent covers the call.

↑↓ to move, Enter to open