Section 9 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sections 9(4) and 9(5) let the law relax two of the child-related duties, verifiable parental consent (9(1)) and the ban on tracking and targeted advertising (9(3)). The first works through the rules, the second through a Central Government notification. Neither touches section 9(2). For help deciding whether any exemption could apply to you, consider a legal consultation.
Section 9(1) and 9(3) do not apply to processing of a child's data by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed (section 9(4)). Separately, the Central Government may, if satisfied that a Data Fiduciary's processing of children's data is verifiably safe, notify an age above which that Data Fiduciary is exempt from all or any of sub-sections (1) and (3) (section 9(5)). Section 9(2) is not mentioned in either. The Act names no class, purpose or age; the detail is in the Rules and notifications.
Sub-sections (4) and (5) at a glance
| Feature | Section 9(4) | Section 9(5) |
|---|---|---|
| Route | Prescribed (rules) | Central Government notification |
| Who benefits | Classes of Data Fiduciaries, or purposes | A particular Data Fiduciary |
| Condition | As prescribed | Central Government must be satisfied processing is verifiably safe |
| What is lifted | Sub-sections (1) and (3) | All or any of the obligations in sub-sections (1) and (3) |
| Age | Not mentioned | The notification specifies an age above which the exemption applies |
| Sub-section (2) | Not affected | Not affected |
Section 9(4): classes and purposes, by rule
Section 9(4) says the provisions of sub-sections (1) and (3) "shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed". Three levers:
- Classes of Data Fiduciaries, for example by kind of business.
- Purposes for which the child's data is processed.
- Conditions the exemption is subject to.
The Act names none of these. "Prescribed" under section 2(v) means prescribed by rules made under the Act. So, apart from the Act's statement that such exemptions are possible, the content is in the Rules. The DPDP Rules, 2025 (notified November 2025) prescribe the detail and different provisions commence on different dates; this article states no class, purpose or condition from them. Read the Rules before relying on an exemption, and read every condition attached to it.
A crucial point is the word "and subject to such conditions". An exemption is not a blanket cancellation. If the conditions are not met, the exemption is not available, and sub-sections (1) and (3) apply as usual.
Section 9(5): a verifiably safe Data Fiduciary and an age threshold
Section 9(5) is a different route. The Central Government "may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3)".
Reading it closely:
- It is discretionary ("may"), and depends on the Central Government being satisfied.
- It is fiduciary-specific: the notification is for "such Data Fiduciary" and "such processing".
- The standard is "verifiably safe", which the Act does not define. The fiduciary needs to be able to show safety, not just claim it.
- The exemption operates above a notified age. The Act does not say what age; the notification will. Below that age, sub-sections (1) and (3) continue to apply to that fiduciary.
- It can cover all or any of the obligations in sub-sections (1) and (3), so a notification could lift one and keep the other.
What section 9(4) and (5) do not cover
The text refers only to sub-sections (1) and (3). They do not refer to:
- Section 9(2), the ban on processing likely to cause a detrimental effect on the well-being of a child. Nothing in the Act lets this be exempted under section 9(4) or (5).
- The other provisions of the Act, such as section 8(5) security safeguards, section 5 notice, or breach intimation. A child-related exemption does not switch these off. Whether they apply is decided under the Act generally and under section 17.
Also remember that a child's parent or lawful guardian counts as the Data Principal under section 2(j)(i) for exercising her rights, so exemptions in section 9 do not remove the parent's rights under Chapter III unless section 17 separately applies. See rights of the Data Principal.
Do not mix up section 9(4) and section 17
Section 17 also contains exemptions, but they are a separate mechanism with their own conditions. Section 17(1) lists situations (such as enforcing a legal claim or prevention and detection of offences) where Chapter II (except sub-sections (1) and (5) of section 8) and Chapter III do not apply. Section 9(4) and (5) are specific to children and do not depend on section 17, and vice versa. A business relying on an exemption should say which provision it is relying on, and meet that provision's own conditions. See section 17.
Commencement and dependence on the Rules
Both provisions depend on something outside the Act: rules in the case of section 9(4), a notification in the case of section 9(5). Until that instrument exists and is in force, the exemption cannot be claimed. Section 1(2) lets the Central Government appoint different dates for different provisions, so check the commencement notification and the Rules for each. See section 1.
Consequence of breach
If a business wrongly assumes an exemption and processes a child's data without parental consent, or tracks or targets children, it faces item 3 of the Schedule: breach in observance of additional obligations in relation to children under section 9, which may extend to two hundred crore rupees, after an inquiry, a hearing and a finding that the breach is significant (section 33(1)). See penalties.
Practical examples
Example 1: relying on an unverified assumption. A business believes its educational purpose is exempt and skips parental consent. If no rule or notification in force covers that class or purpose on the conditions stated, sub-section (1) applies.
Example 2: a notified fiduciary. Suppose a notification under section 9(5) names a Data Fiduciary and an age, and exempts it from sub-section (3) above that age. For users below that age, the ban continues. For the processing the notification covers, nothing in it touches sub-section (2).
Example 3: exempt from tracking but harmful design. Even if an exemption covers behavioural monitoring for a purpose, a feature likely to harm a child's well-being remains barred by section 9(2).
Common mistakes
- Relying on a rumoured or draft exemption rather than the Rules in force.
- Reading "exempt from section 9" when the text says sub-sections (1) and (3).
- Ignoring conditions attached to an exemption.
- Forgetting section 9(2).
Need help reading the exemptions?
Whether an exemption applies turns on the Rules and notifications in force and on your exact processing. Our legal consultation service can help you check the conditions and record why you rely on them.
Key takeaways
- Section 9(4) exemptions come through the rules, by class, purpose and conditions.
- Section 9(5) exemptions come through a notification for a particular Data Fiduciary, for a notified age, where processing is verifiably safe.
- Both can lift only sub-sections (1) and (3).
- Section 9(2) stays in force.
- The Act names no class, purpose or age; check the Rules and notifications.
Read next
- Section 9 of the DPDP Act, 2023: verifiable parental consent
- Section 9 of the DPDP Act, 2023: no tracking or targeted advertising to children
- Section 17 of the DPDP Act, 2023: exemptions for legal claims, courts and offences
- Children's data protection under section 9
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.