Apps for students, games and family services handle children's data, and the rules on it are among the strictest in India and the Gulf. India's DPDP Act treats everyone under 18 as a child and allows penalties of up to ₹200 crore for failures on children's obligations. Qatar classes children's data as special nature data, and Oman requires express parental consent.
Three countries, three approaches
India, Qatar and Oman all require a parent or guardian to agree before a child's data is processed, but they add different extra duties. India bans certain kinds of tracking and advertising. Qatar treats children's data as special nature data that needs regulator approval. Oman adds purpose and data minimisation tests. The table gives the short version before the detail.
| Point | India (DPDP) | Qatar (PDPPL) | Oman (PDPL) |
|---|---|---|---|
| Who is a child | Anyone under 18 | Not specified in this guide's sources | Not specified in this guide's sources |
| Consent | Verifiable parent or guardian consent | Explicit parental consent | Express parental consent |
| Extra duty | No tracking, behavioural monitoring or targeted ads at children | Regulator approval as special nature data | Clear and safe purpose, minimum data, child's best interest |
| In force | 13 May 2027 | Since 29 January 2017 | Transition ended 5 February 2026 |
| Top penalty | Up to ₹200 crore | Up to QAR 5 million | Administrative fines reported up to OMR 2,000 per violation |
India: Section 9 and Rules 10 and 11
Section 9 of the DPDP Act requires verifiable consent from a parent or lawful guardian before processing the personal data of anyone under 18. It also prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rules 10 and 11 of the DPDP Rules 2025 set out how verifiable consent works and extend guardian consent to persons with disabilities. These duties apply from 13 May 2027. Failures on breach notification or children's obligations can draw penalties of up to ₹200 crore.
What the India ban on tracking means for products
The Section 9(3) ban on tracking children affects analytics, recommendation engines and advertising SDKs. An edtech app that uses the same tracking stack for adults and minors will need a separate configuration for users under 18. Your privacy policy should state that you do not track, behaviourally monitor or target advertising at children, and the product should actually behave that way. Test it by running the app as a child account and checking which trackers fire.
Qatar: special nature data
Under Qatar's PDPPL, children's data is special nature data, alongside categories such as health and religion. Processing it needs authorisation from the regulator, now the National Data Privacy Office of the NCSA, and explicit parental consent. Regulator guidelines also require DPIAs, and failure to carry out a required DPIA is reported to attract a QAR 1 million fine. A children's service in Qatar should treat both the approval and the DPIA as launch prerequisites.
Oman: parental consent and best interest
Oman's PDPL and Executive Regulations require express parental consent for children's data. Processing must be for a clear and safe purpose, use the minimum data needed and be in the child's best interest. With the transition period over since 5 February 2026, these duties are now enforceable. Combine them with Oman's general rules: written, provable consent and a mandatory DPO whose contact details are public.
A shared design checklist
If one product serves children in all three countries, build to the strictest combination of rules rather than three variants. In practice that means India's tracking ban, Qatar's approval step and Oman's minimum data test all apply to the same codebase, with country settings used only where a rule truly differs.
- Detect likely child users at sign-up
- Collect verifiable parental consent and keep proof
- Switch off behavioural tracking and targeted ads for children
- Collect only the data the service needs
- Seek Qatar regulator approval before launch
- Run and file a DPIA for the children's service
Next steps
Review the sign-up flow, the analytics stack and the privacy notice together, since each can break the rules on its own. Record why each data point collected from a child is needed. XDQ xAgents (https://xagents.xdqlabs.com) checks whether a privacy policy contains the children's data statements India, Qatar and Oman expect. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
What age counts as a child under India's DPDP Act?
Anyone under 18. Section 9 requires verifiable consent from a parent or lawful guardian before their personal data is processed, and bans tracking, behavioural monitoring and targeted advertising directed at children. These duties apply from 13 May 2027.
Is children's data sensitive in Qatar?
Yes. Qatar's PDPPL treats children's data as special nature data, which needs authorisation from the regulator, and processing requires explicit parental consent. Fines under the PDPPL go up to QAR 5 million.
What does Oman require for children's personal data?
Express parental consent, a clear and safe purpose, the minimum data needed and processing in the child's best interest. Oman's transition period ended on 5 February 2026, so these rules are now enforceable.
What is the DPDP penalty for breaking children's data rules?
Up to ₹200 crore for failures on children's obligations, the same ceiling as for breach notification failures. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Digital Personal Data Protection Act, 2023 (India Code), India Code, Legislative Department, 2023
- Khaitan & Co ERGO: Digital Personal Data Protection Rules (15 November 2025), Khaitan & Co, 2025
- AZB / Shardul Amarchand Mangaldas regulatory alert on DPDP Act enforcement and Rules, Shardul Amarchand Mangaldas & Co, 2025
- Squire Patton Boggs: Qatar's new Protection of Personal Data Privacy Law, Squire Patton Boggs, 2017
- Clyde & Co: Regulatory guidelines on the Qatar Personal Data Protection Law, Clyde & Co, 2021
- Al Tamimi: New Omani Personal Data Protection Law comes into force, Al Tamimi & Company, 2023
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
