DPDP Removal of Difficulties Order 2026: Two Words Changed, Nothing Else Did

In the first week of October 2026, the text of the Digital Personal Data Protection Act, 2023 was changed for what appears to be the first time since it was passed. The DPDP Removal of Difficulties Order, 2026 adds one word to Section 9(1) and one word to Section 10(2)(c)(ii). That is all it does.

Some early coverage makes it sound bigger, as if the rules on consent for children or on audits had changed. They have not. This guide explains what the order says, the two provisions it touches, and what a Data Fiduciary should actually do about it.

What the DPDP Removal of Difficulties Order 2026 says

The order was made on 5 October 2026 and published in the Gazette of India, Extraordinary, as S.O. 5458(E). It makes two changes to the DPDP Act:

• Section 9(1): the words "child or a person with disability" are replaced by "child or of a person with disability".
• Section 10(2)(c)(ii): the word "audit" is replaced by "data audit".

The order came into force on the date of its publication in the Official Gazette. To read the original, search eGazette for the ID CG-DL-E-07102026-276885.

Why the government can edit the Act without Parliament

Section 43(1) lets the Central Government, if any difficulty arises in giving effect to the Act, make an order published in the Official Gazette to remove that difficulty. The order must be "not inconsistent with the provisions of this Act".

The power has two limits. Under Section 43(2), no such order can be made after three years from the commencement of the Act. Under Section 43(3), every order must be laid before each House of Parliament.

Such clauses are meant for repairs, not for policy. As far as we can find, this is the first use of the power under the DPDP Act, and more small fixes would not be a surprise.

Edit one: Section 9(1) and guardian consent

Section 9(1) says that before processing any personal data "of a child or of a person with disability who has a lawful guardian", a Data Fiduciary must obtain the verifiable consent of the parent or the lawful guardian, as the case may be.

The recitals say the missing "of" left the two categories reading as disconnected. It does not widen or narrow who is covered.

What matters in practice is the rule behind each limb, set out in the DPDP Rules, 2025:

• Children (Rule 10). A child is anyone under eighteen. The Data Fiduciary must use due diligence to check that the person giving consent as a parent is an identifiable adult.
• Persons with disability who have a lawful guardian (Rule 11). The Data Fiduciary must use due diligence to verify that the guardian was appointed by a court of law, a designated authority or a local level committee, under the guardianship law that applies.

Two points are often missed. First, Section 9(1) does not cover every person with a disability. It applies where the person has a lawful guardian, and Rule 11 carries its own definition of "person with disability", tied to the Rights of Persons with Disabilities Act, 2016 and the National Trust Act, 1999. Read that definition before assuming who is covered.

Second, the bars in Sections 9(2) and 9(3) on processing likely to harm well-being, on tracking and behavioural monitoring, and on targeted advertising refer only to children. The order does not change that.

The Schedule to the Act sets a penalty of up to Rs 200 crore for breach of the additional obligations in relation to children under Section 9. Our guide to verifiable parental consent under Section 9 covers those obligations in full.

Edit two: Section 10(2)(c)(ii) and the data audit

Section 10 applies only to a Significant Data Fiduciary: a Data Fiduciary, or class of them, that the Central Government notifies after weighing factors such as the volume and sensitivity of personal data processed and the risk to the rights of Data Principals. As of early October 2026, we have not found a notification naming any.

Under Section 10(2), a Significant Data Fiduciary must:

• appoint a Data Protection Officer based in India,
• appoint an independent data auditor to carry out a data audit and evaluate its compliance with the Act, and
• undertake a periodic Data Protection Impact Assessment, a periodic audit and any other measures that are prescribed.

The edit is to the "periodic audit" in the last item. It is now a "periodic data audit", matching the "data audit" the independent auditor carries out. The recitals say the bare word "audit" created ambiguity. On a plain reading, the periodic audit is about data protection, not a financial or general audit.

Rule 13 supplies the frequency. Once every twelve months from the date it is notified, a Significant Data Fiduciary must undertake a Data Protection Impact Assessment and an audit of its compliance with the Act and the Rules. The person carrying them out must report significant observations to the Data Protection Board. The Schedule sets a penalty of up to Rs 150 crore for breach of Section 10 obligations. For the full list of duties, see our guide to the Significant Data Fiduciary under DPDP.

What the order does not change

• No new consent requirement. Verifiable consent from a parent or lawful guardian has been in Section 9(1) since 2023.
• No change to who is a child. The threshold remains eighteen.
• No new duty for Significant Data Fiduciaries, and no change to how they are identified.
• No change to the DPDP Rules, 2025.
• No change to dates. Consent Manager registration under Rule 4 is due to open on 13 November 2026. Sections 9 and 10 are due to apply from 13 May 2027, eighteen months after the Rules were notified on 13 November 2025.

Some reports give March 2027 for Sections 9 and 10. We could not find a basis for that date. Our dates are computed from the November 2025 notifications, so confirm them with your counsel.

What to do now: a five-point checklist

• Update any policy, training deck or contract template that quotes Section 9(1) or Section 10(2)(c)(ii) word for word.
• If you serve users under eighteen, decide how you will verify a parent as an identifiable adult under Rule 10.
• Ask whether your service is ever used on behalf of an adult who has a lawful guardian. If so, plan how you will see and record proof of guardianship under Rule 11.
• If you could plausibly be notified as a Significant Data Fiduciary, budget for a yearly Data Protection Impact Assessment and data audit, and identify who could act as your independent data auditor.
• Keep a simple change log for the Act and the Rules, with gazette references. S.O. 5458(E) can be entry one.

Where Consently fits, and where it does not

Consently is a DPDP-native consent management platform built by G. Giri & Partners LLP. For Section 9, what it offers is age verification: Aadhaar-based verification through DigiLocker / Meri Pehchaan, plus an over-18 self-declaration, alongside granular consent captured for each purpose. Our guide to DPDPA consent covers the wider consent requirements.

It does not verify guardianship documents for persons with disability, and it is not a data audit tool. Those need your own process and your own advisers.

If you want a quick view of where you stand before May 2027, try the compliance calculator or book a demo.

FAQ

Does the DPDP Removal of Difficulties Order 2026 create new obligations?

No. It inserts "of" in Section 9(1) and changes "audit" to "data audit" in Section 10(2)(c)(ii). The order's recitals describe both as textual and editorial corrections.

When did the order come into force?

On the date of its publication in the Official Gazette, in the first week of October 2026. The order is S.O. 5458(E), dated 5 October 2026.

Is verifiable parental consent for children new?

No. Section 9(1) has required verifiable consent from a parent or lawful guardian since the Act was passed in 2023. The order adds one preposition to that sentence.

When do Sections 9 and 10 start to apply?

On our reading, from 13 May 2027, eighteen months after the DPDP Rules were notified on 13 November 2025. The order does not change this.

This article is general information, not legal advice. Please check the Gazette text and speak to your counsel before acting on it.