{"h1":"Data-privacy rules for children's health data in India","faq":[{"a":"Yes. The Digital Personal Data Protection Act, 2023 treats children (under 18) as a protected class, requiring verifiable parental or guardian consent before processing and restricting behavioural tracking and child-targeted advertising.","q":"Does India have a specific law for children's personal data?"},{"a":"Health data is sensitive in nature and carries elevated risk, so responsible custodians apply heightened safeguards — encryption, access control, de-identification for analytics and strict purpose limitation — beyond a bare legal minimum.","q":"Is children's health data treated more strictly than other data?"},{"a":"When a digital tool meets the definition of a medical device, CDSCO Medical Device Rules and SaMD classification apply in parallel with data-protection duties, so data governance must satisfy both regimes.","q":"Do medical-device rules also apply to children's health apps?"}],"lang":"en","slug":"what-data-privacy-rules-apply-to-children-s-health-data-in-india","title":"What data-privacy rules apply to children's health data in India?","entity":{"key":"reg_dpdp","kind":"field_vantage","name":"Regulatory & Compliance","slug":null},"lenses":[{"kind":"stakeholder","label":"Professional","value":"professional"},{"kind":"intent","label":"Support","value":"support"},{"kind":"lifecycle","label":"Plan","value":"plan"},{"kind":"route","label":"About","value":"about"}],"parent":null,"related":[{"lang":"en","slug":"what-are-my-rights-over-my-child-s-health-data","title":"What are my rights over my child's health data?"},{"lang":"en","slug":"how-is-my-child-s-personal-data-protected","title":"How is my child's personal data protected?"},{"lang":"en","slug":"how-is-a-developmental-ai-tool-regulated-by-cdsco-fda-and-eu-mdr","title":"How is a developmental-AI tool regulated by CDSCO, FDA and EU MDR?"},{"lang":"en","slug":"what-consent-and-safeguarding-rules-apply-to-pediatric-therapy","title":"Consent and safeguarding rules in paediatric therapy"},{"lang":"en","slug":"how-does-the-dpdp-act-protect-my-child-s-information","title":"How does the DPDP Act protect my child's information?"},{"lang":"en","slug":"what-data-powers-a-child-developmental-ai-platform","title":"What data powers a child-developmental AI platform?"}],"summary":"Children's health data in India is governed chiefly by the DPDP Act, 2023, which treats under-18s as a protected class requiring verifiable parental consent, bars child-targeted tracking and advertising, and demands data-minimisation and security; health data attracts heightened duty-of-care, with CDSCO SaMD rules applying where a tool is a regulated medical device. AbilityScore® is part of Pinnacle’s developmental assessment. Diagnosis, where needed, requires an appropriately qualified healthcare professional.","answer_md":"*When a child's developmental data is held with care, families can engage therapy with confidence — privacy is the quiet foundation of trust.*\n\n## In short\nChildren's health data in India is governed primarily by the **Digital Personal Data Protection Act, 2023 (DPDP Act)**, which treats children (under 18) as a protected class requiring **verifiable parental consent** before processing, prohibits tracking, behavioural monitoring and targeted advertising directed at children, and bars processing likely to cause harm. Health data is sensitive in nature, so it attracts heightened duty-of-care from any data fiduciary handling it. Where a digital health tool is a regulated medical device, **CDSCO** software-as-a-medical-device (SaMD) obligations apply alongside data-protection duties.\n\n## The regulatory landscape\n- **DPDP Act, 2023** — the cornerstone. Anyone processing a child's personal data must obtain **verifiable consent from a parent or lawful guardian**, process only for clearly stated purposes, and honour rights of access, correction and erasure exercised on the child's behalf. Detrimental processing, behavioural tracking and child-targeted advertising are expressly restricted.\n- **Data fiduciary obligations** — entities must practise purpose limitation, data minimisation, security safeguards, breach notification and retention discipline. Significant data fiduciaries face additional accountability such as data-protection impact assessment and audit duties.\n- **Sensitive nature of health data** — paediatric developmental and clinical data carries elevated risk; responsible custodians apply encryption, access control, de-identification for analytics, and strict role-based handling well beyond a bare legal minimum.\n- **SaMD overlay (CDSCO)** — when a tool meets the definition of a medical device, Medical Device Rules and CDSCO classification apply in parallel; data governance must satisfy both device and privacy regimes.\n- **Sectoral and ecosystem norms** — national digital-health ecosystem frameworks (consent-managed health records) and professional confidentiality expectations reinforce the statutory baseline.\n\n## What this means in practice\nFor any organisation handling children's developmental data, compliance is operational, not merely declarative: verifiable parental consent workflows, transparent purpose statements, de-identified analytics, demonstrable security controls, and clear pathways for guardians to review or withdraw consent. Cross-border transfer, retention limits and breach response should be documented and rehearsed.\n\n## The Pinnacle way\nAbilityScore® is part of Pinnacle’s developmental assessment. Diagnosis, where needed, requires an appropriately qualified healthcare professional — never from an app or online form, and the AbilityScore® is a clinician-administered structured assessment. As a CDSCO Class B SaMD operator serving 4.95 lakh+ families across 70+ centres, our data governance is built to honour parental consent, sensitive-data safeguards and child-protective handling by design. Learn [about Pinnacle](/) , how the [AbilityScore® is conducted](/ask/what-is-the-abilityscore-and-how-is-it-calculated), and how our [speech therapy](https://www.pinnacleblooms.org/top-speech-therapy-center-india-proven-improvement-rate) programmes keep family data protected end-to-end.\n\n## Trusted sources\nWHO guidance on child health and digital health stewardship; WHO ICD framework for clinical classification; national rehabilitation and child-development standards. Statutory authority rests with the DPDP Act, 2023 and CDSCO medical-device rules as applied in India.\n\n**Next step —** Reviewing how your organisation handles children's developmental data? [Contact the Pinnacle compliance team](/) to discuss safeguards and partnership.\n\nThis is general information, not a diagnosis — individual assessment and diagnosis require an appropriately qualified healthcare professional.","canonical":"https://pinnacleblooms.org/ask/what-data-privacy-rules-apply-to-children-s-health-data-in-india","editorial":{"reviewed_at":"2026-06-11T20:12:18.613642+00:00","reviewed_by":null,"developed_by":"SETU Consortium · Pinnacle Blooms Network"},"alternates":[{"href":"https://pinnacleblooms.org/ask/what-data-privacy-rules-apply-to-children-s-health-data-in-india","lang":"en","indexable":true}],"dimensions":[],"meta_title":"Children's Health Data Privacy Rules in India","meta_robots":"index, follow, max-image-preview:large","everyday_tip":"Before sharing your child's developmental information online, check that the service names its purpose, asks for parental consent, and gives you a clear way to access or delete the data later.","published_at":"2026-06-10T14:16:00.221239+00:00","reading_paths":[{"key":"therapy","items":[{"lang":"en","slug":"how-does-the-dpdp-act-protect-my-child-s-information","title":"How does the DPDP Act protect my child's information?","reason":"Linked from this answer"},{"lang":"en","slug":"what-are-my-rights-over-my-child-s-health-data","title":"What are my rights over my child's health data?","reason":"Linked from this answer"},{"lang":"en","slug":"what-consent-and-safeguarding-rules-apply-to-pediatric-therapy","title":"Consent and safeguarding rules in paediatric therapy","reason":"Linked from this answer"},{"lang":"en","slug":"how-is-a-developmental-ai-tool-regulated-by-cdsco-fda-and-eu-mdr","title":"How is a developmental-AI tool regulated by CDSCO, FDA and EU MDR?","reason":"Linked from this answer"},{"lang":"en","slug":"what-data-powers-a-child-developmental-ai-platform","title":"What data powers a child-developmental AI platform?","reason":"Linked from this answer"}],"label":"Explore therapy & support","total":5}],"what_to_watch":"Watch for whether a service obtains verifiable parental consent, states clear purposes, avoids child-targeted tracking or advertising, and offers guardians a way to review, correct or withdraw their child's data.","authority_links":[{"url":"https://www.who.int","label":"WHO — child health and digital health stewardship"},{"url":"https://icd.who.int","label":"WHO ICD clinical classification framework"},{"url":"https://rehabcouncil.nic.in","label":"Rehabilitation Council of India — standards"}],"last_reviewed_at":"2026-06-10T14:16:00.221239+00:00","meta_description":"How India's DPDP Act 2023 and CDSCO rules govern children's health data — verifiable parental consent, data minimisation, security and SaMD duties explaine","related_materials":[],"related_techniques":[]}