DPDP (Removal Of Difficulties) Order, 2026: What Changes In Sections 9 And 10 Of The DPDP Act

Introduction

On 5 October 2026, the Ministry of Electronics and Information Technology (“MeitY”) made the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (the “Order”) under section 43(1) of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”)¹. The Order substitutes words in two provisions of the DPDP Act. The recitals to the Order describe the difficulties as “textual, editorial in nature” and state that there is a need “to rectify the anomalies” in the two provisions “in accordance with the legislative intent”.

Sections 9 and 10 of the DPDP Act are yet to come into force². The substitutions therefore matter now, while businesses design the compliance programmes those provisions will require.

What has changed

Section 9(1): consent for children and persons with disability

Before the Order, section 9(1) of the DPDP Act provided that the Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian, obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be. The recitals to the Order state that the omission of the preposition “of” before the expression “a person with disability” creates a “disjunction” between “any personal data of a child” and the expression “a person with disability”, “thereby obscuring the intended parallelism between the two categories”. In plain terms, the earlier wording could be read as referring to the personal data of a child, followed by a separate reference to a person with disability. Following the substitution, section 9(1) of the DPDP Act refers to “any personal data of a child or of a person with disability who has a lawful guardian”.

Section 9(1) of the DPDP Act provides for verifiable consent to be obtained “in such manner as may be prescribed”, and Rules 10 and 11 of the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) prescribe that manner. The Order does not amend the DPDP Rules. Rule 10 of the DPDP Rules will require a Data Fiduciary to adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child. Rule 11 of the DPDP Rules will require a Data Fiduciary, while obtaining verifiable consent from an individual identifying herself as the lawful guardian of a person with disability, to observe due diligence to verify that such guardian is appointed by a court of law, or by a designated authority or by a local level committee, under the law applicable to guardianship. Section 9(3) of the DPDP Act provides that a Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children; it does not refer to persons with disability.

Section 10(2)(c)(ii): audit obligations of Significant Data Fiduciaries

Section 10(2)(b) of the DPDP Act provides that a Significant Data Fiduciary (“SDF”) shall appoint an independent data auditor to carry out data audit. Before the Order, section 10(2)(c)(ii) of the DPDP Act provided for “periodic audit”. The recitals to the Order state that the repetition of the word “audit” creates “interpretive ambiguity regarding the scope of both categories of audit”, and that a need has been felt to “clarify the scope of the compliance obligation and prevent inconsistent application by regulatory or supervisory authorities” and to clarify that “both references to audit are intended to refer to a ‘data protection audit’ or ‘data audit’”. Following the substitution, section 10(2)(c)(ii) of the DPDP Act refers to “periodic data audit”, using the expression “data audit” that appears in section 10(2)(b) of the DPDP Act.

The Order does not amend Rule 13 of the DPDP Rules. Rule 13 of the DPDP Rules will require an SDF, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, to undertake a Data Protection Impact Assessment and “an audit”, and to cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Data Protection Board of India a report containing significant observations. Rule 13 of the DPDP Rules does not refer to section 10 of the DPDP Act.

Practical takeaways

1. Where personal data of a person with disability who has a lawful guardian will be processed, provide for verifiable consent of the lawful guardian, with the due diligence required by Rule 11 of the DPDP Rules, in addition to verifiable consent of the parent for children under Rule 10 of the DPDP Rules.
2. Data Fiduciaries likely to process personal data of children or of persons with disability should test their consent-verification flows against Rules 10 and 11 of the DPDP Rules.
3. Entities that expect to be notified as SDFs should review auditor engagement terms and audit checklists against each of section 10(2)(b) and section 10(2)(c)(ii) of the DPDP Act and Rule 13 of the DPDP Rules.
4. Track the phased commencement. Under the notification issued by the Central Government under section 1(2) of the DPDP Act, sections 6(9) and 27(1)(d) of the DPDP Act will come into force one year from the date on which the notification was published in the Official Gazette, while sections 9 and 10 of the DPDP Act will come into force eighteen months from that date³. Similarly, under Rule 1 of the DPDP Rules, Rule 4 of the DPDP Rules will come into force one year after the DPDP Rules were published in the Official Gazette, while Rules 10, 11 and 13 of the DPDP Rules will come into force eighteen months after that date⁴.

Conclusion

The Order does not amend the DPDP Rules or affect the commencement of sections 9 and 10 of the DPDP Act. Sections 9 and 10 of the DPDP Act will come into force as they read following the Order: section 9(1) of the DPDP Act refers to “any personal data of a child or of a person with disability who has a lawful guardian”, and section 10(2)(c)(ii) of the DPDP Act refers to “periodic data audit”. Data Fiduciaries should review their consent mechanisms, and entities that expect to be notified as SDFs should review their audit planning, against these provisions and the DPDP Rules.

Footnotes

1. S.O. 5458(E), Gazette of India, Extraordinary, Part II, Section 3(ii), No. 5248, dated 6 October 2026.

2. G.S.R. 843(E), Gazette of India, Extraordinary, Part II, Section 3(i), No. 757, dated 13 November 2025.

3. G.S.R. 843(E), Gazette of India, Extraordinary, Part II, Section 3(i), No. 757, dated 13 November 2025.

4. G.S.R. 846(E), Gazette of India, Extraordinary, Part II, Section 3(i), No. 760, dated 13 November 2025, as corrected by the Corrigenda, G.S.R. 892(E), Gazette of India, Extraordinary, Part II, Section 3(i), No. 806, dated 11 December 2025.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.