On 3rd December, the Government of India proposed detailed rules under the Digital Personal Data Protection Rules, 2025. One of the most talked-about aspects of the draft is the rule that makes verifiable parental consent mandatory for creating social media accounts and processing the personal data of children. The measure is part of a larger effort by the Indian government to regulate digital platforms and uphold the rights of data principals, specifically minors.
If implemented, the rules will compel social media platforms to ensure that consent for any data collection, processing, or storage comes from verified parents or legal guardians. Notably, this will apply to all services, including social media platforms, educational apps, and other legal platforms targeting or catering to minors. Furthermore, parents will have the power to withdraw consent at any time, and the platforms will be obliged to cease data processing as soon as such a request is placed.
Comprehensive verification process to safeguard consent
The rules further outline a stringent verification mechanism to authenticate the identity of parents. Platforms will be mandated to use reliable tools, such as government-backed systems like Digilocker, to ensure that only legally competent adults provide consent. Verification measures include cross-checking identity and age credentials, thereby ensuring a robust layer of accountability.
Furthermore, platforms cannot collect unnecessary data and will be required to process only what is essential for delivering specific services. In cases where the platform needs to retain data to comply with existing laws, parents must be informed at least 48 hours before the data is deleted so they can take any required action.
Limits on data retention and processing
The rules will also limit the duration for which minors’ data can be stored. Once the purpose of data processing is fulfilled, the platform is obligated to delete it unless specific laws mandate its retention. Additionally, platforms must clearly notify parents about the data retention and deletion timeline, thereby providing greater transparency.
Platforms must also maintain technical and organisational measures, such as encryption and controlled access, to safeguard children’s personal information. Any breaches, if they occur, must be promptly reported to affected individuals and the Data Protection Board, detailing the nature of the breach and corrective measures undertaken.
Broader regulatory implications
The rules focus on protecting the personal data of users in India. They outline how organisations must handle, process, and protect data while ensuring compliance with existing laws. As per the draft rules, every organisation that collects personal data must provide clear and simple information about what it needs, why it needs it, how it will be used, and your rights. For example, they are obligated to disclose what kind of data is being collected and how consent can be withdrawn or complaints filed.
Platforms are obligated to provide options for managing and giving consent for the use of personal data. These special platforms for managing data must meet strict conditions. They must be financially stable and provide technical safeguards to protect individuals’ data.
Government agencies are also brought under the ambit of the new proposed rules. While they can process personal data to provide benefits, services, or licences, they must follow specific rules and process only the data necessary for their services.
The new rules mandate organisations to implement strong safeguards to protect personal data from breaches. These include using encryption and monitoring systems to detect unauthorised access. If your data is leaked or accessed without permission, the organisation must inform you and the government promptly. They should include details such as what happened, the risks involved, and measures to protect yourself.
The rules will give you the facility to access, correct, and delete your data. Organisations must make it easy for you to exercise these rights through clear channels like websites or apps. Furthermore, personal data can only be sent outside India under conditions specified by the government, ensuring the receiving country or organisation provides similar data protection.
In a press release, the Ministry of Electronics and Information Technology said, “The draft Rules details about the various implementation aspects such as the notice by the Data Fiduciary to the individuals, registration and obligations of Consent Manager, processing of personal data for issuance of subsidy, benefit, service etc. by State, applicability of reasonable security safeguards, intimation of personal data breach, providing details about availing of their rights by the individuals, processing of personal data of child or person with disability, setting up the Data Protection Board, appointment and service conditions of the Chairperson and other members of the Board, functioning of Board as digital office, procedure to appeal to Appellate Tribunal among others.”
Regarding the feedback, the ministry said, “In this regard, feedback/comments may be submitted via the MyGov portal at the following link: https://innovateindia.mygov.in/dpdp-rules-2025 and the last date for submission is 18th February 2025.”
The draft rules can be checked here.
