Rule 11 — Verifiable Consent for Processing of Personal Data of Person with Disability Who Has Lawful Guardian

Section 2(j)(ii) of the Act folds a lawful guardian into the definition of "Data Principal" for a person with disability who has one — the guardian steps in and acts on her behalf, the way a parent does for a child. Section 9(1) then extends the same verifiable-consent requirement to this case. Rule 11 is what makes that consent verifiable, and its structure mirrors Rule 10's — but where Rule 10 checks that a parent is an identifiable adult, Rule 11 checks something else entirely: that the person claiming to be a lawful guardian was actually appointed as one, through a recognised legal process.

What has to be verified — Rule 11(1)

A Data Fiduciary obtaining verifiable consent from someone identifying herself as the lawful guardian of a person with disability has to observe due diligence to confirm that guardian was appointed by a court of law, by a designated authority, or by a local level committee, under the law applicable to guardianship. There's no self-declaration route here comparable to Rule 10's "reliable details already held" path for a returning user — the object being checked is the appointment itself, which by definition traces back to one of these three sources.

Two different laws, depending on the disability — Rule 11(2)(b)

"Law applicable to guardianship" splits along the same line the Act's own "person with disability" definition draws. For an individual with a long-term physical, mental, intellectual or sensory impairment who, despite adequate and appropriate support, is unable to take legally binding decisions, the relevant law is the Rights of Persons with Disabilities Act, 2016 and its rules. For a person with autism, cerebral palsy, mental retardation, or a combination of these conditions — including severe multiple disability — the relevant law is the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999 and its rules. These aren't interchangeable: verifying a guardian's appointment under the wrong statute doesn't satisfy Rule 11 for the disability category actually involved.

The three appointing sources — Rule 11(2)(a) and (c)

A "designated authority" is one designated under Section 15 of the Rights of Persons with Disabilities Act, 2016, to support persons with disabilities in exercising their legal capacity. A "local level committee" is one constituted under Section 13 of the National Trust Act, 1999. Together with a court of law, these are the three sources Rule 11(1) recognises as capable of appointing a lawful guardian — a caretaker who has simply taken on the role informally, however genuinely, doesn't meet this standard without an actual appointment traceable to one of the three.

Why this matters in practice

The practical risk Rule 11 addresses is a Data Fiduciary accepting a self-declared caretaker's word as if it were a verified guardianship. Because the underlying legal frameworks differ by disability category, due diligence here isn't a single checklist — it requires knowing which of the two statutes applies to the person with disability in question, and checking the guardian's appointment against the right one. A Data Fiduciary that only ever asks "do you have a guardianship document" without distinguishing which Act it should have been issued under risks accepting paperwork that doesn't actually establish lawful guardian status for that category.

Illustration: a telehealth platform is asked to create an account on behalf of an adult with a severe intellectual disability, by someone identifying as her guardian. If that individual's condition falls under the National Trust Act's categories — autism, cerebral palsy, mental retardation, or severe multiple disability — the platform's due diligence has to confirm the guardian was actually appointed by a local level committee under that Act (or by a court), not merely that some document exists. Accepting an informal family arrangement as sufficient, without checking it against the correct statutory appointment process, doesn't meet Rule 11.

How Rule 11 connects to the rest of the Rules and the Act

Rule 11 operationalises Section 9(1) for this specific category of Data Principal, and shares the "verifiable consent" definition in Rule 2(1)(d) with Rule 10's parental-consent mechanics — the two rules are the Act's two verification pathways for consent given by someone other than the Data Principal herself. Where Rule 10 exemptions run through Rule 12 and the Fourth Schedule for children specifically, Rule 11 carries no equivalent carve-out in the primary text — the guardianship-verification duty applies wherever Section 9(1) reaches a person with disability who has a lawful guardian.