A parent’s guide to your child’s data rights

When your child signs up to anything online, somebody starts holding information about them. India's Digital Personal Data Protection Act 2023 sets out what that organisation must do and what you are entitled to ask for.

This is a plain-language summary written so you can use it. It is not legal advice, and where something matters, the Act itself and a qualified adviser are the authorities, not us.

The short version

An organisation holding your child's personal data must:

• Tell you what it collects and why, in clear language, before it collects it
• Obtain verifiable consent from a parent or guardian for anyone under 18
• Collect only what it actually needs for the stated purpose
• Not run behavioural advertising, tracking or profiling directed at children
• Delete it when the purpose has been served, apart from what other law requires it to keep
• Let you withdraw consent, and make withdrawing about as easy as giving it

That fourth point is stronger for children than for adults, and it is the one most commonly ignored.

What "verifiable consent" actually means

Not a tick-box on the student's own sign-up form. The organisation has to take a real step to establish that a parent or guardian — an actual adult, distinct from the child — has agreed.

In practice that looks like a separate message to you, with a summary of what is being collected and why, and a deliberate action from you to agree. If your child joined something and you were never contacted, that process did not happen.

What you can ask for, and how

You can ask any organisation holding your child's data:

• What do you hold? You are entitled to a summary.
• Why do you hold it, and for how long?
• Who else has it? Processors, if any.
• Please correct this. Something wrong should be fixed.
• Please delete it. Subject to what law requires them to keep.
• I withdraw consent.

Put it in an email. You do not need to give a reason, and you do not need a lawyer to ask. A reasonable organisation confirms within a few working days.

What a good answer looks like

A good answer names the actual fields. "Name, email, phone number, school, city, date of birth, the work submitted, and payment records." A poor answer says "certain information to improve your experience", which is a sentence written to avoid being specific.

A good answer gives real retention periods with reasons, and is willing to say which parts it cannot delete and why — accounting records, for instance, usually have a statutory retention period, and an organisation offering to delete those is either mistaken or not keeping proper books.

Our answers

So you have something to compare against:

Two things worth watching for generally

A privacy policy that never mentions children. If a service is plainly aimed at school students and its policy has no section on minors, nobody has thought about this.

Analytics that follow a child around. A site can count visits without identifying anybody. If a service aimed at children carries advertising trackers, that is a choice somebody made.

If something goes wrong

Start with the organisation, in writing. Say what you want — correction, deletion, withdrawal of consent — and keep the reply.

If you do not get a satisfactory response, the Act provides for escalation to the Data Protection Board. We are not the right people to advise you on that process, and anyone telling you it is simple has not been through it. But the first step is always the same: ask in writing, and keep what comes back.

Finally

You are allowed to ask these questions without being apologetic about it, and an organisation that treats the question as an inconvenience has answered it. The ones worth trusting tend to have the answers ready, because they had to think them through in order to build the thing properly in the first place.