SCENARIO E02 · CHILDREN & GUARDIANS
An age-assurance flow uploads a full identity document only to check whether a parent is an adult. What should the design seek?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Use a proportionate method and consider reliable existing details or an authorised virtual token.
Meet the verification objective with the least intrusive reliable flow available and record what was checked rather than collecting reflexively.
WHY THE OTHER INSTINCTS MISS
Use a proportionate method and consider reliable existing details or an authorised virtual token.
Correct as design guidance. Future Rule 10 allows several verification routes; it does not require retaining a full document in every case.
Store the full identity document indefinitely for proof.
Indefinite storage is not a necessary consequence of verifying adulthood and creates additional risk.
Skip parent verification whenever the child knows the parent’s name.
A name alone does not meet the future Rule 10 due-diligence design.
BUILD THIS EVIDENCE
Age-assurance design record, data-fields list, verification source and deletion trigger.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- implementation indicator
- Pinpoint
- Act s. 9(1); Rule 10(1)–(2); G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)