Legal Register
RULE-SCHEDULE-IV Tranche 3 (13 May 2027) — Core Operating Cliff
Status: scheduled, not yet operative
Schedule IV: r12
Do not generalise safety/education into child targeted-ad permission.
Regulated Actor: Listed child-processing classes/purposes
Gazette Baseline: Lines 1682–1765
Subordinate Trigger
r12
Applies to: Listed child-processing classes/purposes
Rule Prescriptions
Five PartA classes and six PartB purposes with exact scope conditions; definitions corrected to (a)-(g).
Exceptions & Provisos
Relief only s9(1),(3); s9(2) remains.
Official Gazette Text (Verbatim Rules Publication)
Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025.
FOURTH SCHEDULE
[See rule 12]
PART A
Classes of Data Fiduciaries in respect of whom provisions of sub-sections (1) and (3) of section 9 shall
not apply
S.
Class of Data Fiduciaries Conditions
No.
(1) (2) (3)
1. A Data Fiduciary who is a clinical Processing is restricted to provision of health
establishment, mental health establishment services to the child by such establishment or
or healthcare professional. professional, to the extent necessary for the
protection of her health.
2. A Data Fiduciary who is an allied Processing is restricted to supporting implementation
healthcare professional. of any healthcare treatment and referral plan
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 37
recommended by such professional for the child, to
the extent necessary for the protection of her health.
3. A Data Fiduciary who is an educational Processing is restricted to tracking and behavioural
institution. monitoring—
(a) for the educational activities of such institution;
or
(b) in the interests of safety of children enrolled
with such institution.
4. A Data Fiduciary who is an individual in Processing is restricted to tracking and behavioural
whose care infants and children in a crèche monitoring in the interests of safety of children
or child day care centre are entrusted. entrusted in the care of such institution, crèche or
centre.
5. A Data Fiduciary who is engaged by an Processing is restricted to tracking the location of
educational institution, crèche or child care such children, in the interests of their safety, during
centre for transport of children enrolled the course of their travel to and from such institution,
with such institution, crèche or centre. crèche or centre.
PART B
Purposes for which provisions of sub-sections (1) and (3) of section 9 shall not apply
S.
Purposes Conditions
No.
(1) (2) (3)
1. For the exercise of any power, performance Processing is restricted to the extent necessary for
of any function or discharge of any duties in such exercise, performance or discharge.
the interests of a child, under any law for the
time being in force in India.
2. For providing or issuing of any subsidy, Processing is restricted to the extent necessary for
benefit, service, certificate, licence or permit, such provision or issuance.
by whatever name called, under law or policy
or using public funds, in the interests of a
child, under clause (b) of section 7 of the Act.
3. For the creation of a user account for Processing is restricted to the extent necessary for
communicating by email. creating such user account, the use of which is
limited to communication by email.
4. For the determination of real-time location of Processing is restricted to the tracking of real-time
a child. location of such child, in the interest of her safety
and protection or security.
5. For ensuring that any information, service or Processing is restricted to the extent necessary to
advertisement likely to cause any detrimental ensure that such information, service or
effect on the well-being of a child is not advertisement is not accessible to the child.
accessible to her.
6. For confirmation by the Data Fiduciary that Processing is restricted to the extent necessary for
the Data Principal is not a child and such confirmation or observance.
observance of due diligence under rule 10.
Note: In this Schedule, —
38 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]
(a) “advertisement” shall have the same meaning as is assigned to it in the Consumer Protection Act,
2019 (35 of 2019).
(a) “allied healthcare professional” shall have the same meaning as is assigned to it in the clause (d) of
section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);
(b) “clinical establishment” shall have the same meaning as assigned to it in the clause (c) of section 2
of the Clinical Establishments (Registration and Regulation) Act, 2010 (23 of 2010);
(c) “educational institution” shall mean and include an institution of learning that imparts education,
including vocational education;
(d) “healthcare professional” shall have the same meaning as is assigned to it in clause (j) of section 2
of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);
(e) “health services” shall mean the services required to be provided by a healthcare professional as
referred to in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions
Act, 2021 (14 of 2021); and
(f) “mental health establishment” shall have the same meaning as is assigned to it in clause (p) of sub-
section (1) of section 2 of the Mental Healthcare Act, 2017 (10 of 2017).
Mapped Operational Controls (1)
Enterprise obligations in the Control Master Matrix implementing this subordinate rule.