Digital Personal Data Protection Act 2022/23 of India

SCHEDULE-IV

See rule 11

Exemptions from processing per personal data of Child u/s 9(4)

Section 9(4) of the Act

(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed

Sections 9(1) and 9(3)

(1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.

(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

Table

Class of Data Fiduciaries to whom and purpose for which provisions of sub-sections (1) and (3) of section 9 to not apply

Sl No Class of Data Fiduciaries or Purpose Conditions

(1) (2) (3)

1 Data Fiduciaries entrusted by any law for the time being in force in India, to exercise any power, perform any function or discharge any responsibility in the interests of the child and any persons directed by them in the furtherance of such interests Restricted to the extent necessary for such exercise, performance, discharge or carrying out of such a direction

2 State and its instrumentalities as Data Fiduciaries provding or issuing subsidy, benefit, service, certificate, license or permit as referred to in rule 5 Restricted to the extent necessary for such provision or issuance in respect of a child, in her interest

3 Data Fiduciaries who are clinical establishments, mental health establishments or healthcare professionals Restricted to provision of health services to a child, to the extent necessary for the protection of her health

4 Data Fiduciaries who are allied healthcare professionals Restricted to supporting implementation of any healthcare treatment and referral plan recommended by a healthcare professional for a child, to the extent necessary for the protection of her health

5 Data Fiduciaries who are educational institutions Restricted to supporting implementation of any healthcare treatment and referral plan recommended by a healthcare professional for a child, to the extent necessary for the protection of her health.

6 Data Fiduciaries who are individuals in whose care infants and children in creches or child day care centers are entrusted Restricted to tracking and behavioural monitoring in the interest of safety of a child enrolled with such institutions, creche or centre

7 Data Fiduciaries who are engaged by an educational institution, creche or child care centre for transport of children enrolled with such institution, creche or centre Restricted to tracking the location of such a child, in the interests of her safety, during the course of her travel to and from such institution, creche or centre.

8 For the purpose of-
(a) confirmation by the Data Fiduciary that the Data Principal is not a child; or
(b) observance of due diligence by the Data Fiduciary under rule 10 in respect of any individual identifying herself as the parent of a child whose personal data is to be processed Restricted to the extent necessary for such confirmation or observance

Note:
In this schedule,-
(a) "allied healthcare professional" shall have the same meaning as is assigned to it in the National Commission for Allied and Healthcare Professionals Act 2021 (14 of 2021)
(b)"clinical establishment" shall have the same meaning as is assigned to it in the Clinical establishments (registration and Regulations) act 2010 (23 of 2010)
(c) "educational institution" means and includes an institution of learning that imparts education, including vocational education, which is-
(i) established, owned or controlled by or under a Central Act or State Act
(ii) established, owned, controlled or recognized by the Central Government, a State Government or a local authority
(iii) recognized by a body which is established by law for the co-ordination and determination of standards in institutions for higher education or research and scientific and technical institutions and is empowered to regulate such institutions
(iv) affiliated to a University or
(v) declared as an institution deemed to be University under the Universities Grants Commission Ac 1956 (3 of 1956)
(d) "healthcare professional" shall have the same meaning as is assigned to it in the National commission for Allied and Healthcare Professionals Act, 2021 (14 of 2021)
(e) "health services" means the services referred to in clause (j)of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021)
(f) "local authority" shall have the same meaning as is assigned to it in the Right of Children to free and compulsory education act 2009 (35 of 2009)
(g) "mental health establishment" shall have the same meaning as is assigned to it in the Mental HealthCare Act 2017 910 of 2017) and
(h) "university" shall have the same meaning as is assigned to it in the Universities Grants Commission Ac 1956 (3 of 1956)

Sl No	Class of Data Fiduciaries or Purpose	Conditions
(1)	(2)	(3)
1	Data Fiduciaries entrusted by any law for the time being in force in India, to exercise any power, perform any function or discharge any responsibility in the interests of the child and any persons directed by them in the furtherance of such interests	Restricted to the extent necessary for such exercise, performance, discharge or carrying out of such a direction
2	State and its instrumentalities as Data Fiduciaries provding or issuing subsidy, benefit, service, certificate, license or permit as referred to in rule 5	Restricted to the extent necessary for such provision or issuance in respect of a child, in her interest
3	Data Fiduciaries who are clinical establishments, mental health establishments or healthcare professionals	Restricted to provision of health services to a child, to the extent necessary for the protection of her health
4	Data Fiduciaries who are allied healthcare professionals	Restricted to supporting implementation of any healthcare treatment and referral plan recommended by a healthcare professional for a child, to the extent necessary for the protection of her health
5	Data Fiduciaries who are educational institutions	Restricted to supporting implementation of any healthcare treatment and referral plan recommended by a healthcare professional for a child, to the extent necessary for the protection of her health.
6	Data Fiduciaries who are individuals in whose care infants and children in creches or child day care centers are entrusted	Restricted to tracking and behavioural monitoring in the interest of safety of a child enrolled with such institutions, creche or centre
7	Data Fiduciaries who are engaged by an educational institution, creche or child care centre for transport of children enrolled with such institution, creche or centre	Restricted to tracking the location of such a child, in the interests of her safety, during the course of her travel to and from such institution, creche or centre.
8	For the purpose of- (a) confirmation by the Data Fiduciary that the Data Principal is not a child; or (b) observance of due diligence by the Data Fiduciary under rule 10 in respect of any individual identifying herself as the parent of a child whose personal data is to be processed	Restricted to the extent necessary for such confirmation or observance