Data Protection Board of India narrows guardian consent rule for disabled users

What happened

• The Quantum Hub report examines how mainstream consumer devices serve as assistive technology for disabled users in India.
• It highlights that Section 9 of the DPDP Act originally required guardian consent for any disabled person with a guardian, regardless of decision‑making capacity.
• Rule 11 of the DPDP Rules, finalised in November 2025, narrows the consent trigger to cases where the individual cannot take legally binding decisions despite adequate support.
• The report calls for further consultation on the remaining gaps in the framework.

Why it matters

Entities that process personal data from disabled users must now assess decision‑making capacity rather than applying a blanket guardian‑consent rule, aligning with the Rights of Persons with Disabilities Act.

Business impact

Businesses will need to redesign consent workflows for assistive‑technology users, potentially adding capacity assessments and documentation to avoid non‑compliance.

What to check

1. 1

   Implement capacity assessmentsHigh priority

   Determine whether each disabled user can make legally binding decisions with appropriate support before seeking guardian consent.

2. 2

   Update consent recordsMedium priority

   Document the outcome of capacity assessments and retain evidence of consent or guardian approval as required.