Apaar, state family IDs may be used to verify guardians for processing children's data under DPDP

The Digital Personal Data Protection Rules 2025 was released for consultation on January 3

Emerging digital identity frameworks such as the Apaar ID — a unified national digital ID for students — and state-level family IDs can be used to verify parents or guardians for processing children's data under the draft Digital Personal Data Protection Rules, a government official has said.

The Automated Permanent Academic Account Registry (APAAR) ID is a student identification system that is part of the "One Nation, One Student ID" programme.

While a centralised family ID system does not yet exist at the national level, several states, including Andhra Pradesh, Rajasthan, Tamil Nadu and Haryana, have already implemented localised identification systems for families.

These frameworks can be integrated into the verification process for parental consent under the DPDP Rules, the official added.

The approach aligns with the draft rules' stress on adopting verifiable parental consent mechanisms to safeguard children's personal data.

The draft rules say that data fiduciaries must implement technical and organisational measures to verify the identity of parents or guardians, including checks using government-issued IDs or digital tokens linked to trusted services such as digital locker providers.

Data fiduciaries are entities or individuals which store, collect and process personal data and are responsible for ensuring its protection under the DPDP Act.

Questions, however, remain regarding data interoperability across state-level systems and privacy. The DPDP Rules address some of these concerns by mandating reasonable security safeguards and requiring consent managers to oversee data processing while ensuring compliance with audit requirements.

On January 7, Union Minister Ashwini Vaishnaw, while assuring that privacy will remain central to the rules, said virtual tokens used for verifying children's data will be temporary and automatically deleted after a single use.

The minister also said the rules would continue to evolve, adapting lessons learnt during implementation to ensure children can safely benefit from technology.

“We will refine it (DPDP Rules) further to take the power of technology to children while saving them from many harm,” he said.

The DPDP Rules were released for consultation on January 3 and people have been asked to send their feedback and suggestions till February 18.