NEW DELHI: Safeguarding the best interests of the child should be the guiding principle for statutory regulation on protecting data of children, a government-appointed panel said on Friday.

It defined a child as one below 18. "At the moment, keeping in view the fact that the age for majority in the Contract Act is 18 and the provision of consent for data sharing is often intertwined with consent to contract, the age of 18 is recommended as the age below which a person is classified as a 'child' for the purpose of this law," the Justice BN Srikrishna Committee report on data protection said.

All data companies must process data relating to children keeping their best interests in mind.

The Data Processing Authority (DPA) shall have the power to notify data fiduciaries (companies) who operate commercial websites or online services directed at children, or who process large volumes of personal data of children as 'guardian data fiduciaries'.

At present, the panel said there were two categories of data fiduciaries who may be processing personal data of children: first, services offered primarily to kids (YouTube Kids app, Hot Wheels , Walt Disney) and second, social media services ( Facebook , Instagram ).

For guardian data fiduciaries (companies), certain types of processing that were harmful would be impermissible. They will have to incorporate appropriate age-verification and parental-consent mechanisms.

