Data rules draft: focus on minors, national security

A draft of rules for India's data protection law has proposed that parents must identify themselves before their children can join certain online platforms.

- Shouvik Das

The draft also proposes giving exceptional powers to the Centre on matters said to be of national security.

These are part of the first draft of rules that will enforce the Digital Personal Data Protection (DPDP) Act, 2023. The draft rules were published on the website of the ministry of electronics and information technology (Meity) on Friday for public consultation.

Among key points, personal data has been mandated to be localized in India, barring in cases and countries as exempted by the Centre.

Then, parents and guardians will have to verify their identity before an individual under 18 years of age can sign up for a 'significant' online platform. Firms operating online platforms will have to ensure that verifiable parental consent is obtained before an individual below 18 years of age signs up for a platform.

The draft rules also state that companies must observe "due diligence for checking that the individual identifying herself as the parent is an adult who is identifiable, if required".

Such a verifiable identity can be established through a "verified token", or through DigiLocker-the Centre's Aadhaar-linked digital identity storage and authentication platform-the rules state.