Design Verifiable Parental Consent with Digital Locker Evidence
Map adult identity, parental authority, and consent in a child account workflow. Read DPDP Rule 10 and plan approved evidence and withdrawal handling.
Design parental consent as a workflow with distinct evidence. Identify the consenting adult, establish the relationship or authority needed for the case, and bind consent to the child's account and purpose.
The final Digital Personal Data Protection Rules, 2025 describe identity and age checks for verifiable parental consent in Rule 10. They include specified reliable details and an authorised entity token route. The definition includes qualifying details or tokens made available and verified by a Digital Locker service provider. Final DPDP Rules
Read Rule 10 with its commencement and scope
Rule 1 places Rule 10 in the group commencing eighteen months after Gazette publication. Check the current commencement notices and applicable exemptions for the product before treating a workflow as required. Rule 12 and the relevant schedule describe exemptions subject to their conditions. Final DPDP Rules
The official illustrations describe checking that the person identifying themselves as a parent is an identifiable adult. They include scenarios with existing reliable information and voluntarily supplied evidence. Review the evidence your organisation may use for the actual case.
Design separate decisions
| Decision | Evidence or policy to define |
|---|---|
| Who is the adult? | Reliable identity evidence under the approved route |
| Does the evidence establish adulthood? | Reliable age information or applicable verified token |
| May this adult act in this case? | The relationship or authority process appropriate to the workflow |
| What did the adult agree to? | Purpose, notice version, and a recorded consent action |
| Which account may proceed? | A link between the approved request and the child's account |
A valid login proves control of an account. Keep that event separate from evidence of adulthood and the authority needed for the case.
Walk through a synthetic child account request
An education application receives a request to create a learner account. It starts a pending case and gives the adult a separate route to review the request. The adult sees the relevant purpose and notice.
The application checks the required identity and age evidence through its approved process. It resolves the authority and account binding required for that case. It then records the adult's consent and evaluates whether the account can proceed.
If a consent link is forwarded to another account, pause the case. Review who received the link and whether that person can act before you record consent.
Record a minimal consent history
- Assign the case a reference.
- Record the permitted evidence method.
- Bind the verified adult reference to the intended case.
- Record the notice version and consent action.
- Apply the current account policy.
- Record any withdrawal or later change.
Decide which fields you need and how long you may retain them. Keep raw documents and identifiers out of routine logs. Preserve the relevant decisions so a reviewer can understand what happened.
For withdrawal, identify affected processing and assign an owner to each downstream action. Review how a later change in account status affects access. Engineering consent withdrawal.
Review your account design with NamoID
NamoID engineers can help model adult and child accounts, consent events, and application access. The driving licence preview has a separate scope. Discuss the approved evidence route before using any verification result for parental consent.
Share a synthetic family-account flow and the decisions your product needs to support. Message the NamoID team in Slack