On 5 October 2026, the Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, to remove drafting ambiguities relating to consent requirements and data audit obligations under the Digital Personal Data Protection Act, 2023 (DPDP Act).
The Order came into effect on 6 October 2026.
Key Highlights:
-
The Order has been issued under Section 43(1) of the DPDP Act, empowering the Central Government to remove difficulties arising in the implementation of the Act.
-
The Order seeks to remove drafting and interpretational ambiguities in Sections 9 and 10 of the Act, providing greater clarity on consent requirements and data audit obligations applicable to Data Fiduciaries and Significant Data Fiduciaries.
-
Section 9(1) requires a Data Fiduciary to obtain verifiable consent before processing the personal data of a child or a person with disability who has a lawful guardian.
-
To address the ambiguity in the provision, the Order substitutes the words “child or a person with disability” with “child or of a person with disability” in Section 9(1).
-
The clarification reinforces that verifiable consent should be obtained before processing:
-
Personal data of a child; and
-
Personal data of a person with disability who has a lawful guardian.
-
-
Section 10(2)(c)(ii) also contained interpretational ambiguity regarding audit obligations applicable to Significant Data Fiduciaries.
-
To remove this ambiguity, the word “audit” in Section 10(2)(c)(ii) has been substituted with the expression “data audit”.
-
The clarification aligns Section 10(2)(c)(ii) with Section 10(2)(b), which already requires Significant Data Fiduciaries to appoint an independent data auditor for carrying out a data audit.
Also Read: Digital Personal Data Protection (DPDP) Rules, 2025: Key Highlights of the Newly Notified Framework
[DPDP (Removal of Difficulties) Order, 2026, dated 05-10-2026]
