Rule 12 — Exemptions From Certain Obligations for Processing a Child's Data

Section 9(4) of the Act authorises the Central Government to prescribe classes of Data Fiduciaries, or purposes, for which sub-sections (1) and (3) of Section 9 don't apply to processing a child's personal data — subject to whatever conditions are attached. Rule 12 is that prescription, and it works entirely by reference to the Fourth Schedule: Part A lists exempt classes of Data Fiduciary, Part B lists exempt purposes, and both parts attach a condition that narrows the exemption to exactly the activity described, not to the Data Fiduciary's operations generally.

What's actually exempted — and what isn't

Rule 12(1) relieves Section 9(1) — the requirement to obtain verifiable consent of a parent or lawful guardian before processing — for the classes listed in Fourth Schedule Part A. Rule 12(2) relieves Section 9(1) and Section 9(3) — the ban on tracking, behavioural monitoring or targeted advertising directed at children — for the purposes listed in Fourth Schedule Part B. In both cases, the relief is conditional: it only applies "subject to such conditions as are specified in the said Part," so the exemption and its condition are one package, not a status you acquire and then apply broadly.

Section 9(2) — the ban on processing that's likely to cause any detrimental effect on a child's well-being — has no exemption anywhere in Rule 12 or the Fourth Schedule. Every class in Part A and every purpose in Part B still has to clear that bar. Nothing in this rule is a general licence to process a child's data more freely; it narrowly lifts a consent requirement or a monitoring ban for specific, conditioned situations.

Part A — five classes of Data Fiduciary

Fourth Schedule Part A names five classes, each tied to a condition that limits the exemption to the activity the class exists to perform:

• Clinical establishments, mental health establishments and healthcare professionals — exempt only for processing restricted to providing health services to the child, to the extent necessary for protecting her health.
• Allied healthcare professionals — exempt only for processing restricted to supporting a healthcare treatment or referral plan another professional has recommended for the child.
• Educational institutions — exempt only for tracking and behavioural monitoring done for the institution's educational activities, or in the interests of the safety of children enrolled there.
• Individuals operating a crèche or child day care centre — exempt only for tracking and behavioural monitoring in the interests of the safety of children entrusted to their care.
• Transport providers engaged by an educational institution, crèche or day care centre — exempt only for tracking a child's location, in the interests of her safety, during travel to and from that institution.

Part B — six purposes

Fourth Schedule Part B works differently — it exempts a purpose regardless of who the Data Fiduciary is, again subject to a matching condition:

• Exercising a power, performing a function or discharging a duty in a child's interest under any law in force in India — limited to what's necessary for that exercise, performance or discharge.
• Issuing a subsidy, benefit, service, certificate, licence or permit under law, policy or public funds, in a child's interest under Section 7(b) of the Act — limited to what's necessary for that provision or issuance.
• Creating a user account for email communication — limited to creating the account, where its use stays limited to email.
• Determining a child's real-time location — limited to tracking for her safety, protection or security.
• Ensuring information, a service or an advertisement likely to harm a child's well-being isn't accessible to her — limited to what's necessary to enforce that restriction.
• Confirming a Data Principal isn't a child, and the due-diligence age-verification Rule 10 requires — limited to what's necessary for that confirmation or observance.

Why this matters in practice

The Fourth Schedule's conditions read narrow because they're meant to be read narrow. Being an "educational institution" doesn't exempt everything the institution does with a student's data — it exempts tracking and behavioural monitoring for educational activities or student safety, specifically. If the same institution's app also profiles students to target them with third-party advertising, that processing sits outside Part A entirely and needs verifiable parental consent under Section 9(1) like any other Data Fiduciary's would.

The recurring failure mode is treating class membership as the exemption, rather than the conditioned activity. A healthtech platform that qualifies as a clinical establishment for one product line doesn't get to extend that exemption to an unrelated wellness-content feature aimed at the same child — the condition travels with the specific processing, not with the corporate entity.

Illustration: a school's learning-management platform tracks which students complete assignments and flags unusual absence patterns for staff review — squarely inside Part A's educational-institution exemption. If the same platform later adds a feature that profiles students' browsing behaviour to recommend third-party tutoring products, that feature needs its own lawful basis, because "recommending products" isn't "educational activities or child safety," and Part A's condition doesn't stretch to cover it.

How Rule 12 connects to the rest of the Rules and the Act

Rule 12 sits downstream of Rule 10, which sets out how verifiable parental consent actually gets obtained and verified where no exemption applies, and Rule 11, which covers the parallel verification duty for a lawful guardian's authority when the Data Principal is a person with disability. Where Rule 12 exempts a class or purpose, Rules 10 and 11 simply don't come into play for that processing. At the Act level, Rule 12 implements Section 9(4) specifically — Section 9(1)'s consent duty and Section 9(3)'s tracking ban are what get relieved, while Section 9(2)'s harm ban, Section 9(5)'s separate age-notification mechanism, and every other Section 9 obligation continue to apply in full.