DPDP (Removal of Difficulties) Order, 2026: Key Clarifications and Compliance
Introduction
The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (“Order”) on 5 October 2026. This order was issued under Section 43(1) of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), addressing the drafting ambiguities in Sections 9(1) and 10(2)(c)(ii) of the Act.
- Consent for Children and Persons with Disabilities
Section 9 of the DPDP Act prescribes special requirements for processing the personal data of children and persons with disabilities in specified circumstances. A child is an individual who has not completed eighteen years of age. The Act requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian, as applicable under the statutory framework.
For persons with disabilities, the relevant requirements concerning consent from a lawful guardian apply where the statutory conditions are satisfied, including where the individual is unable to take legally binding decisions despite adequate support.
This Order amends Section 9(1) by replacing the words “child or a person with disability” with “child or of a person with disability”. This textual correction clarifies the distinction between the two categories of Data Principals covered by the provision.
A Data Fiduciary is a person who, alone or in conjunction with others, determines the purpose and means of processing personal data. Here, he must continue to comply with the applicable requirements for obtaining verifiable parental consent for processing a child’s personal data and consent from a lawful guardian where the statutory conditions concerning a person with a disability are satisfied.
Accordingly, organisations should examine whether their existing consent mechanisms adequately address the requirements applicable to both categories, including the relevant verification procedures prescribed under the DPDP Rules.
- Clarification of Data Audit Requirements
Section 10 of the DPDP Act imposes additional obligations on SDFs. Unlike Data Fiduciaries that are not designated as significant, SDFs must comply with additional statutory requirements intended to address the risks associated with their personal data processing activities.
These obligations include appointing an independent data auditor to carry out a data audit and undertaking the assessments required under the Act. A data audit examines relevant personal data processing practices and compliance with applicable data protection requirements; it is distinct from a general financial or operational audit.
The Order replaces the word “audit” with “data audit” in Section 10(2)(c)(ii). This change aligns the terminology with Section 10(2)(b), which expressly refers to the appointment of an independent data auditor.
The clarification identifies the relevant audit as a data audit within the DPDP framework and reinforces the need for SDFs to assess their personal data processing practices against the applicable data protection requirements.
A Significant Data Fiduciary (SDF) is a Data Fiduciary notified as such by the Central Government based on factors prescribed under the Act, including the volume and sensitivity of personal data processed and the potential risks to the rights of Data Principals. They should review their existing audit arrangements, including the scope of the audit, the engagement of the independent data auditor and the documentation maintained to demonstrate compliance.
- Practical Compliance Takeaways
In light of the Order and the DPDP Rules, organisations should consider the following measures:
- Review consent mechanisms: Assess whether existing procedures adequately address verifiable consent requirements for children and persons with disabilities, including applicable verification requirements under the DPDP Rules.
- Assess SDF applicability: Evaluate whether the organisation may fall within the criteria for designation as an SDF and identify the additional compliance obligations that would arise from such designation.
- Review audit arrangements: SDFs should assess whether their audit scope, auditor engagement and supporting documentation adequately address compliance with the DPDP framework.
- Update internal documentation: Review privacy notices, consent templates, internal policies and compliance procedures referring to Sections 9 and 10 to ensure consistency with the clarified provisions.
- Prepare for phased implementation: Review the commencement schedule under the DPDP Act and DPDP Rules and establish an implementation plan covering consent, security safeguards, personal data breach notifications, data retention and Data Principal rights, as and when the relevant provisions become applicable.
Conclusion
The DPDP (Removal of Difficulties) Order, 2026 introduces targeted textual clarifications concerning consent requirements and data audit obligations rather than establishing an entirely new set of compliance requirements. Nevertheless, the amendments provide organisations with an opportunity to review their existing consent and audit frameworks and identify potential compliance gaps.
Organisations should assess these clarifications alongside the DPDP Act and the phased implementation of the DPDP Rules, 2025, while ensuring that their compliance measures are aligned with the statutory obligations applicable to them.
