Rule 11 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 11 deals with consent for a person with disability who has a lawful guardian. A Data Fiduciary obtaining verifiable consent from an individual who says she is the lawful guardian must observe due diligence to verify that the guardian was appointed by a court, a designated authority or a local level committee, under the law applicable to guardianship.
Rule 11 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. The Data Fiduciary must observe due diligence to verify that the individual is the guardian, appointed by a court of law, a designated authority or a local level committee, under the law applicable to guardianship. Rule 11(2) defines four terms by reference to two other Acts. The rule does not say how to verify.
Rule 11 and the Act
Section 9(1) of the Act requires verifiable consent from the parent or lawful guardian of a child, or of a person with disability who has a lawful guardian, before processing personal data. Rule 10 deals with the parent of a child; see rule 10. Rule 11 deals with the guardian of a person with disability. The Act's text is in Section 9 of the DPDP Act: verifiable parental consent. Rule 2(1)(d) defines "verifiable consent" as consent "as specified in rule 10 or 11"; see rules 1 and 2.
Rule 1(4) places rule 11 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date.
Services for persons with disabilities, such as health, education, banking and assistive technology, may need a verification step for guardians, and a legal consultation can help design one that fits the text.
Rule 11(1): due diligence on the guardian
"A Data Fiduciary, while obtaining verifiable consent from an individual identifying herself as the lawful guardian of a person with disability, shall observe due diligence to verify that such guardian is appointed by a court of law, or by a designated authority or by a local level committee, under the law applicable to guardianship."
The rule has four parts:
- Trigger: the Data Fiduciary is obtaining verifiable consent from an individual who identifies herself as the lawful guardian of a person with disability.
- Duty: "observe due diligence to verify". The standard is due diligence; the rule does not require a particular document.
- What is verified: that the guardian "is appointed" by one of three: a court of law, a designated authority, or a local level committee.
- Under which law: "under the law applicable to guardianship", a term defined in sub-rule (2)(b).
Compare rule 10, which asks the Data Fiduciary to check that a parent is an adult who is identifiable. Rule 11 asks something different: that the guardian was appointed by a recognised body.
Rule 11(2): the four definitions
| Term | Meaning |
|---|---|
| "designated authority" (a) | An authority designated under section 15 of the Rights of Persons with Disabilities Act, 2016 (49 of 2016) to support persons with disabilities in exercise of their legal capacity |
| "law applicable to guardianship" (b) | (i) For an individual with long term physical, mental, intellectual or sensory impairment who, despite adequate and appropriate support, is unable to take legally binding decisions: the provisions of the Rights of Persons with Disabilities Act, 2016 and the rules made under it. (ii) For a person suffering from any of the conditions relating to autism, cerebral palsy, mental retardation or a combination of such conditions, including severe multiple disability: the provisions of the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999 (44 of 1999) and the rules made under it |
| "local level committee" (c) | A local level committee constituted under section 13 of the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999 |
| "person with disability" (d) | (i) an individual with long term physical, mental, intellectual or sensory impairment which, in interaction with barriers, hinders full and effective participation in society equally with others and who, despite being provided adequate and appropriate support, is unable to take legally binding decisions; and (ii) an individual suffering from any of the conditions relating to autism, cerebral palsy, mental retardation or a combination of any two or more of such conditions, including an individual suffering from severe multiple disability and who, despite adequate and appropriate support, is unable to take legally binding decisions |
The terms are printed in the Rules' own language, including "mental retardation", which is quoted as it appears in the text of the 1999 Act's title and in the Rules. The two Acts are named only by title, section and number; this article does not describe anything inside them, and a reader should consult them directly.
Two features of the definitions are worth noting. First, "person with disability" is defined by an inability to take legally binding decisions even with adequate and appropriate support, in both limbs. It is a narrower group than every person with a disability. Second, the applicable law depends on the person's condition: the 2016 Act for the first group, the 1999 Act for autism, cerebral palsy, mental retardation, multiple disabilities, severe multiple disability.
How a business might apply it
The rule requires verification of the appointment. The sources of the appointment are three, and each links to a law: a court of law; a designated authority under section 15 of the 2016 Act; and a local level committee under section 13 of the 1999 Act. A Data Fiduciary may therefore ask a person who presents herself as a guardian for the order or certificate of appointment, and check which body issued it. What the order looks like is not in the Rules, so the Data Fiduciary should record what it examined and why it was satisfied. This is a practical reading of "due diligence", not something the Rule prescribes.
Example (invented): TeleCare, a tele-counselling platform, is asked to register Rohan, an adult who cannot take legally binding decisions despite adequate support. His sister Seema says she is his lawful guardian. TeleCare asks her for the order appointing her, checks that it was issued by a court, a designated authority or a local level committee, and records the check before it obtains consent and processes Rohan's data. The Rules contain no Illustration for rule 11; this example is ours.
What rule 11 does not say
- It does not say what happens if verification fails; the text is silent, but the rule's purpose is that verifiable consent is obtained.
- It does not name documents or a portal.
- It does not state a penalty; see the Schedule to the Act.
- Rule 12 and the Fourth Schedule contain exemptions from section 9(1) and (3) for children; see rule 12. Whether any exemption touches persons with disability is for the text of the Fourth Schedule.
For overview reading, see children's data protection under section 9, written before the Rules.
Need help verifying guardians?
Where a service reaches persons with disabilities, the verification step needs a clear policy and a record. Talk to our legal team about a checklist that matches rule 11 and your product.
Key takeaways
- Rule 11 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- The Data Fiduciary observes due diligence that the guardian is appointed by a court of law, a designated authority or a local level committee, under the law applicable to guardianship.
- "Designated authority" refers to section 15 of the Rights of Persons with Disabilities Act, 2016; "local level committee" to section 13 of the National Trust Act, 1999.
- "Person with disability" in the rule means a person unable to take legally binding decisions despite adequate and appropriate support.
- The rule prescribes no particular document.
- Later amendments and notifications should be checked.
Read next
- Rule 10: verifiable consent of a parent for a child's personal data
- Rules 1 and 2: definitions and staged commencement
- Section 9 of the DPDP Act: verifiable parental consent
- Children's data protection under section 9
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.