Introduction
On October 05, 2026, Ministry of Electronics and Information Technology published Notification (Extraordinary) regarding Digital Personal Data Protection (Removal of Difficulties) Order, 2026[1] making two word-level corrections: one in Section 9(1) on children and persons with disability, and one in Section 10(2)(c)(ii) on audits by Significant Data Fiduciaries (SDFs).
The order has been released at a significant stage in the implementation of India’s data protection framework. The DPDP Rules, 2025, notified on 13 November 2025, are being operationalized in phases, with the Data Protection Board and certain institutional provisions already in force, the Consent Manager framework scheduled to take effect in November 2026, and the core compliance obligations becoming applicable in May 2027.
By addressing these ambiguities now, before the substantive obligations take effect, the Government has sought to provide greater clarity in the interpretation and implementation of the Digital Personal Data Protection (“DPDP”) Act, 2023. Although the changes involve only a few words, they have an important bearing on how regulated entities understand and operationalise their compliance responsibilities.
What does the Order Say
The Order seeks to amend Section 9 of the DPDP Act which talks about “Processing of Personal Data of Children” and Section 10 which talks about “Additional obligations of Significant Data Fiduciary”.
Position of DPDP Act before the Order:
| Provision under DPDP Act | Position before the Order | Position after the Order |
| Section 9(1) | The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed. | For the words, “child or a person with disability” the Order has now included the word “of” before the text “a person with disability”. The complete section will now be read as: “The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.” |
| Section 10(2)(c)(ii) | The Significant Data Fiduciary shall— (c) undertake the following other measures, namely:— (i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed; (ii) periodic audit; |
For the word “audit”, the Order has now included the words “data audit” The complete section will now be read as: The Significant Data Fiduciary shall— (c) undertake the following other measures, namely:— (i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed; (ii) periodic data audit; |
What does the change means for businesses
Although the amendments introduced through the DPDP (Removal of Difficulties) Order, 2026 are largely clarificatory in nature, they provide important guidance on how businesses should interpret and implement their obligations under the DPDP Act before the penalties take effect from May 2027.
The amendment to Section 9(1) reaffirms that verifiable consent must be obtained before processing the personal data of a child or of a person with disability who has a lawful guardian, thereby underscoring the need for organisations to establish robust age-verification and guardian-consent mechanisms where such individuals may use their products or services. This clarification is particularly relevant for sectors such as healthcare, e-commerce, consumer-facing digital platforms, and EdTech, which frequently process the personal data of children or persons with disabilities and must therefore implement enhanced safeguards to ensure lawful processing and compliance with the DPDP Act.
Similarly, the amendment to Section 10(2)(c)(ii) clarifies that Significant Data Fiduciaries are specifically required to undertake periodic data audits, reinforcing need for organisations to comprehensively map their data processing activities across both internal and external functions, establish a Data Governance framework, review end-to-end data flows, and regularly assess compliance with their data protection obligations. The clarification also reinforces that the focus of such audits is specifically on data protection and privacy compliance, rather than on general business, operational, or financial audits as mandated under Company laws.
The Companies may undertake periodic data audits “Annually” [as also required under Rule 8 of existing Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011)][2] or bi-annually, and should also be undertaken whenever there is a significant change in existing data processing activities or the introduction of a new processing activity, system, product, or service that involves the processing of personal data.
Way forward for Businesses
Before the DPDP compliance obligations become fully enforceable, businesses should:
- Review and update privacy notices, policies, and consent mechanisms.
- Implement age-verification and parental/guardian consent processes, where applicable.
- Identify and map processing of children’s and disabled persons’ data.
- Conduct periodic data mapping exercises.
- Establish a data governance and compliance framework.
- Plan and undertake periodic data audits, particularly for prospective SDFs.
- Review vendor and processor agreements to align with DPDP requirements.
- Strengthen data retention, deletion, and purpose-limitation practices.
- Train employees and relevant stakeholders on DPDP compliance obligations.
- Monitor future notifications, Rules, SDF designations, and guidance issued under the DPDP framework.
HOW S.S. RANA & CO. CAN ASSIST
S.S. Rana & Co. advises organisations across sectors on data protection compliance, privacy policy drafting, vendor contract review, and regulatory strategy under the DPDP Act. Our team can assist with:
- DPDP Act readiness assessments and gap analyses
- Data Governance Frameworks
- Drafting and reviewing consent notices, privacy policies, and children’s data protection policies
- Vendor Due Diligence
- Third-Party Risk Management
- Training sessions for in-house teams, HR, and senior management
- Grievance mechanism design and implementation support
[1] MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY ORDER, New Delhi, the 5th October, 2026 S.O. 5458(E)
[2] Rule 8(4) – Reasonable Security Practices and Procedures – The audit of reasonable security practices and procedures shall be carried cut by an auditor at least once a year or as and when the body corporate or a person on its behalf undertake significant upgradation of its process and computer resource