MeitY corrects two phrases in the DPDP Act: what the Removal of Difficulties Order, 2026 changes

Order dated 5 October 2026. Gazette of India Extraordinary, issue No. 5248, dated 6 October 2026. Last checked: 14 October 2026.

What the Order is

The Ministry of Electronics and Information Technology (MeitY) issued S.O. 5458(E) on 5 October 2026 under Section 43(1) of the Act. That section lets the Central Government make provisions that are not inconsistent with the Act when a difficulty arises in giving effect to it. Under paragraph 1(2), the Order came into force on the date of its publication in the Official Gazette.

What changed

Provision	Before	After
Section 9(1), children and persons with disability	"child or a person with disability"	"child or of a person with disability"
Section 10(2)(c)(ii), Significant Data Fiduciaries	"audit"	"data audit"

Section 9(1): one added word

Section 9(1) requires a Data Fiduciary to obtain verifiable consent of the parent of a child, or of the lawful guardian, as the case may be, before processing the personal data of a child or of a person with disability who has a lawful guardian. The Order says that leaving out "of" before "a person with disability" created a disjunction between the two categories and obscured the intended parallelism between them. The added word makes the two categories read as parallel.

Section 10(2)(c)(ii): "audit" becomes "data audit"

Section 10(2)(b) already requires a Significant Data Fiduciary to appoint an independent data auditor to carry out a data audit. Section 10(2)(c)(ii) used only the word "audit" for the periodic audit. The Order says this repetition created interpretive ambiguity. It clarifies that both references mean a data protection audit or data audit, to prevent inconsistent application by regulatory or supervisory authorities.

What the Order does not change

• No new duty. The Order describes the difficulties as textual and editorial in nature.
• No new audit frequency. It clarifies the kind of audit, not how often it happens.
• No change to dates. Under the commencement notification G.S.R. 843(E), Sections 3 to 5, 6(1) to (8) and (10), 7 to 17 and others come into force eighteen months after publication, which is 13 May 2027. That group includes Sections 9 and 10.
• No wider audit duty. Section 10 applies to Significant Data Fiduciaries only. As of 13 October 2026, we found no official notification of any Significant Data Fiduciary.

What to check in your organisation

• Documents that quote Section 9(1). If a policy, notice or template reproduces the old wording, update it.
• Consent design for children. Rule 10 of the DPDP Rules, 2025 requires technical and organisational measures for verifiable parental consent, with due diligence that the person is an identifiable adult. This Order does not change that.
• Audit planning. If you may be designated a Significant Data Fiduciary, plan for a data protection audit and an independent data auditor.

Frequently asked questions

Is the Removal of Difficulties Order a new privacy law?

No. It makes two word-level corrections to the existing DPDP Act, 2023, using the power in Section 43(1).

Does every business now need a data audit?

No. The audit wording sits in Section 10, which applies to Significant Data Fiduciaries only.

Does every person with a disability now need guardian consent?

No. Section 9(1) refers to a person with disability who has a lawful guardian.

Do the new wordings apply immediately?

The Order itself is in force. The duties in Sections 9 and 10 start on 13 May 2027 under G.S.R. 843(E).

Sources

• Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), Gazette of India Extraordinary
• Commencement notification G.S.R. 843(E), 13 November 2025
• Section 9 of the DPDP Act on this site and Section 10

This is general information, not legal advice. Check the Gazette text and speak to your counsel before acting on it.