DPDP Rules: Educational, health institutions may be exempted from restrictions on children’s data processing

In what can come as a relief to various quarters of the industry, the government may exempt educational institutions, health establishments, and certain government entities from the restrictions on the processing of children's data mandated under the Digital Personal Data Protection (DPDP) Act.

These exemptions are outlined in an unreleased version of the draft rules of the DPDP Act, which is expected to be released soon. Although the DPDP Act was passed in August 2023, certain clauses of the legislation require additional rules to define the framework's details. The government plans to notify the rules by January 2024.

The entities eligible for this exemption include government entities that perform functions related to the "interests of a child," healthcare professionals, creche or childcare institutions, and government bodies that issue subsidies, licenses, and so on.

For healthcare institutions, the exemption may be restricted to the provision of healthcare services to a child; educational institutions will be allowed to undertake behavioral monitoring and tracking of educational activities.