Minor patients: consent and records at a clinic in India Who is a minor, when a parent's written consent is needed, and what the DPDP exemption for health care covers.

In India a patient under 18 is a minor. That is the age of majority in section 3 of the Majority Act, 1875, and the DPDP Act, 2023 defines a child the same way. For the clinic, two consent questions follow. Consent to a procedure: regulation 7.16 of the 2002 conduct regulations asks for written consent from a parent or guardian before an operation on a minor. Consent to the data: section 9 of the DPDP Act requires a parent's verifiable consent before a child's personal data is processed, but the DPDP Rules, 2025 exempt clinics and healthcare professionals from that requirement where the processing is restricted to giving health services to the child. Anything outside that, such as marketing messages, is not exempt.

This post does not cover when a minor can consent to a particular treatment on their own; that is a clinical and legal judgement for the treating doctor, and the place to ask is your state medical council or a lawyer. General consent practice is in informed consent in an OPD.

Who counts as a minor?

Every person domiciled in India shall attain the age of majority on his completing the age of eighteen years and not before.

Section 3(2) adds that the day of birth counts as a whole day and the person "shall be deemed to have attained majority at the beginning of the eighteenth anniversary of that day". Section 2 of the same Act carves out marriage, dower, divorce, adoption and religious matters, which do not affect a clinic. The DPDP Act's section 2(f) says "child" means "an individual who has not completed the age of eighteen years", and rule 10(2)(a) of the DPDP Rules defines an "adult" as "an individual who has completed the age of eighteen years". So the registration desk has one number to work with: 18.

When is a parent's written consent needed for treatment?

The 2002 regulations speak to operations directly. Regulation 7.16: "Before performing an operation the physician should obtain in writing the consent from the husband or wife, parent or guardian in the case of minor, or the patient himself as the case may be. In an operation which may result in sterility the consent of both husband and wife is needed." For an OPD that does minor procedures, that means a signed form from the parent or guardian on file before the procedure. The regulations do not set out a written-consent rule for a routine consultation, and we do not fill that gap here.

For teleconsultation, paragraph 3.2.3 of the Telemedicine Practice Guidelines, 25 March 2020 says the RMP "needs to explicitly ask the age of the patient, and if there is any doubt, seek age proof. Where the patient is a minor, after confirming the age, tele consultation would be allowed only if the minor is consulting along-with an adult whose identity needs to be ascertained."

What does the DPDP Act require for a child's data?

Section 9(1): "The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed." The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), 5 October 2026) corrected the wording of this sub-section to read "child or of a person with disability"; the substance for a clinic is unchanged. Section 9(2) bars processing "likely to cause any detrimental effect on the well-being of a child". Section 9(3) bars "tracking or behavioural monitoring of children or targeted advertising directed at children".

Rule 10 of the DPDP Rules, 2025 sets the method: the Data Fiduciary checks "that the individual identifying herself as the parent is an adult who is identifiable", by reference to identity and age details it already holds, or details voluntarily provided by the individual or through a virtual token from an authorised entity, including DigiLocker.

The health-care exemption

Section 9(4) lets the Rules exempt classes of Data Fiduciaries from sub-sections (1) and (3). Rule 12(1) does so for the classes in Part A of the Fourth Schedule. Item 1 reads:

The Schedule's note borrows its definitions. "Clinical establishment" has the meaning in section 2(c) of the Clinical Establishments (Registration and Regulation) Act, 2010, which includes a "clinic" and one owned or managed by "a single doctor". "Healthcare professional" and "health services" are tied to section 2(j) of the National Commission for Allied and Healthcare Professions Act, 2021; we did not read that Act this session, so a doctor relying on the professional limb rather than the establishment limb should check it.

Three limits follow from the wording. The exemption covers only sections 9(1) and 9(3); section 9(2) still applies. It covers only processing "restricted to provision of health services to the child". And only "to the extent necessary for the protection of her health". Registering the child, keeping the visit record, printing the prescription and sending the token are health services. A birthday greeting, a festival offer or a newsletter sent to the child's number are not, and need the parent's verifiable consent, if they are sent at all.

Timing: section 9 is among the provisions that G.S.R. 843(E) brings into force eighteen months after 13 November 2025, and rules 10 and 12 commence on the same date under rule 1(4).

What the front desk should do

1. Record the date of birth, not just the age, so the record shows when the patient turns 18.
2. Record who accompanied the minor and their relationship. Regulation 7.16 names "parent or guardian"; note when the adult is neither.
3. For any procedure, take the parent's or guardian's written consent before it starts and file it with the visit.
4. Register the child's record under the parent's mobile number and say so on the form; messages go to the adult.
5. Use the child's data only for the child's care. Do not add minors to promotional broadcast lists.
6. When the patient turns 18, the records stay with the clinic, but requests for them now come from the patient, not the parent. Regulation 1.3.2 speaks of "the patients / authorised attendant".