FOURTH Schedule

FOURTH SCHEDULE [See rule 12] PART A Classes of Data Fiduciaries in respect of whom provisions of sub-sections (1) and (3) of section 9 shall not apply S. Class of Data Fiduciaries Conditions No.

(1) (2) (3)

1. A Data Fiduciary who is a clinical Processing is restricted to provision of health establishment, mental health establishment services to the child by such establishment or or healthcare professional. professional, to the extent necessary for the protection of her health.

2. A Data Fiduciary who is an allied Processing is restricted to supporting implementation healthcare professional. of any healthcare treatment and referral plan

recommended by such professional for the child, to the extent necessary for the protection of her health.

3. A Data Fiduciary who is an educational Processing is restricted to tracking and behavioural institution. monitoring—

(a) for the educational activities of such institution; or

(b) in the interests of safety of children enrolled with such institution.

4. A Data Fiduciary who is an individual in Processing is restricted to tracking and behavioural whose care infants and children in a crèche monitoring in the interests of safety of children or child day care centre are entrusted. entrusted in the care of such institution, crèche or centre.

5. A Data Fiduciary who is engaged by an Processing is restricted to tracking the location of educational institution, crèche or child care such children, in the interests of their safety, during centre for transport of children enrolled the course of their travel to and from such institution, with such institution, crèche or centre. crèche or centre.

PART B Purposes for which provisions of sub-sections (1) and (3) of section 9 shall not apply S. Purposes Conditions No.

(1) (2) (3)

1. For the exercise of any power, performance Processing is restricted to the extent necessary for of any function or discharge of any duties in such exercise, performance or discharge. the interests of a child, under any law for the time being in force in India.

2. For providing or issuing of any subsidy, Processing is restricted to the extent necessary for benefit, service, certificate, licence or permit, such provision or issuance. by whatever name called, under law or policy or using public funds, in the interests of a child, under clause (b) of section 7 of the Act.

3. For the creation of a user account for Processing is restricted to the extent necessary for communicating by email. creating such user account, the use of which is limited to communication by email.

4. For the determination of real-time location of Processing is restricted to the tracking of real-time a child. location of such child, in the interest of her safety and protection or security.

5. For ensuring that any information, service or Processing is restricted to the extent necessary to advertisement likely to cause any detrimental ensure that such information, service or effect on the well-being of a child is not advertisement is not accessible to the child. accessible to her.

6. For confirmation by the Data Fiduciary that Processing is restricted to the extent necessary for the Data Principal is not a child and such confirmation or observance. observance of due diligence under rule 10.

Note: In this Schedule, —

(a) “advertisement” shall have the same meaning as is assigned to it in the Consumer Protection Act, 2019 (35 of 2019).

(a) “allied healthcare professional” shall have the same meaning as is assigned to it in the clause (d) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);

(b) “clinical establishment” shall have the same meaning as assigned to it in the clause (c) of section 2 of the Clinical Establishments (Registration and Regulation) Act, 2010 (23 of 2010);

(c) “educational institution” shall mean and include an institution of learning that imparts education, including vocational education;

(d) “healthcare professional” shall have the same meaning as is assigned to it in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);

(e) “health services” shall mean the services required to be provided by a healthcare professional as referred to in clause (j) of section 2 of the National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021); and

(f) “mental health establishment” shall have the same meaning as is assigned to it in clause (p) of sub- section (1) of section 2 of the Mental Healthcare Act, 2017 (10 of 2017).