Step 12 of DPDPA compliance addresses the most sensitive data categories: children under 18, persons with disabilities, and cross-border transfers—often overlooked but heavily scrutinized.
You cannot rely on a child's consent directly; you must obtain verifiable consent from a lawful guardian, and cross-border transfers may be restricted to certain countries by government notification.
Decide early: if you don't target minors, explicitly state "Our services are intended for individuals 18 years and above" in your policy.
If you do, introduce guardian consent forms, collect evidence (email, signed form, school-provided consent), and embed this into your registration process.