DPDP Rules: Educational, health institutions may be exempted from restrictions on children’s data processing

The Digital Personal Data Protection Act became a law in August 2023 after it was passed in both the houses of the Parliament

In what can come as a relief to various quarters of the industry, the government may exempt educational institutions, health establishments, and certain government entities from the restrictions on the processing of children's data mandated under the Digital Personal Data Protection (DPDP) Act.

These exemptions are outlined in an unreleased version of the draft rules of the DPDP Act, which is expected to be released soon. Although the DPDP Act was passed in August 2023, certain clauses of the legislation require additional rules to define the framework's details. The government plans to notify the rules by January 2024.

The entities eligible for this exemption include government entities that perform functions related to the "interests of a child," healthcare professionals, creche or childcare institutions, and government bodies that issue subsidies, licenses, and so on.

For healthcare institutions, the exemption may be restricted to the provision of healthcare services to a child; educational institutions will be allowed to undertake behavioral monitoring and tracking of educational activities.

The plan to exempt such institutions was also relayed to the industry the government held on December 20. The government had said that these exemptions are likely to be included in a schedule that will be released by the ministry as part of the data protection rules.

The DPDP Act defines a child as someone below the age of 18 and mandates that parental consent is required to process the data of a child. The law also puts a bar on tracking children behavioural monitoring or targeted advertising at children.

These provisions have evoked concern from members of the civil society and industry alike. They had argued earlier that such imposition of restrictions on processing children's data may curtail innovation.

One of the major tasks of the industry including Big Tech companies was to lower the definition of the age of children from meaning those below the age of 18 to those below the age of 14.