The MeITY notified the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) on October 5, 2026, and it came into force on October 6, 2026. It is issued under section 43(1) of the DPDP Act, which allows the Centre to remove difficulties in giving effect to the Act through provisions not inconsistent with it. The Order makes two amends.
Under section 9(1), the words “child or a person with disability” has been replaced with “child or of a person with disability”. The missing “of” had blurred the link between the two categories. The correction makes clear that a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian before processing the personal data of a child, and also the personal data of a person with disability who has a lawful guardian.
In section 10(2)(c)(ii), “audit” is replaced with “data audit”. This aligns the periodic audit required of Significant Data Fiduciaries with the independent “data audit” already mandated under section 10(2)(b). The Order’s preamble adds that both audits are meant to be data protection audits. Since a preamble only guides interpretation and is not operative text, the amendment itself carries more weight than that statement.
The Order is clarificatory and creates no new obligation as it does not alter the substance of either provision. Its practical value is in removing doubt about who must consent under section 9 and what the audit duties are covered under section 10. Both are yet to be implemented, so the effect is on compliance planning rather than any immediate duty.
For further information, please contact:
Archana Balasubramanian, Partner, Agama Law Associates
archana@agamalaw.com
