The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 changes two phrases in the DPDP Act and nothing more. It adds the word "of" to Sec. 9(1), and it turns "periodic audit" into "periodic data audit" in Sec. 10(2)(c)(ii). No deadline, Rule, Schedule or duty moves. It was made on 5 October 2026, published in the Gazette on 6 October 2026 as S.O. 5458(E), and came into force on publication.
If your compliance work was already pointed at the Act, you do not need to redo it. You may need to correct a quotation.
What the Order is, and the power behind it
Sec. 43(1) of the Act says that if any difficulty arises in giving effect to its provisions, the Central Government may, by order published in the Official Gazette, make provisions "not inconsistent with the provisions of this Act" that appear necessary or expedient for removing the difficulty. Sec. 43(2) bars any such order after three years from the Act's commencement, and Sec. 43(3) requires each order to be laid before both Houses of Parliament.
The Order is made under that power. Its own recitals describe the difficulties as textual and editorial in nature. The text of the Order, signed by a Joint Secretary in MeitY, is in the official Gazette PDF on the MeitY website (Gazette of India, Extraordinary, Part II, Section 3(ii), 6 October 2026).
The two changes, word for word
Clause 2 of the Order makes two substitutions.
Sec. 9(1), processing of children's data. The words "child or a person with disability," are replaced by "child or of a person with disability".
- Before: "...before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be..."
- After: "...before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be..."
Sec. 10(2)(c)(ii), Significant Data Fiduciaries. For the word "audit" the words "data audit" are substituted.
- Before: "(ii) periodic audit; and"
- After: "(ii) periodic data audit; and"
What did not change
The Order contains two substitutions and a commencement clause, and that is all. It does not amend any other section of the Act, any of the DPDP Rules, 2025, or the Schedule to Sec. 33(1).
- Dates. Consent Manager provisions still commence on 13 November 2026 and the remaining substantive provisions, which include Sec. 9 and Sec. 10, on 13 May 2027. See what commences when.
- Rules. Rule 10, Rule 11, Rule 12 and Rule 13 read as they did.
- Penalties. The Schedule is untouched. See DPDP penalties.
- Who is covered. The Order touches neither the definition of a child nor Sec. 10(1), the provision under which a Data Fiduciary is notified as significant.
Why the Sec. 10 fix matters in practice
Sec. 10(2) puts two separate audit-type duties on a Significant Data Fiduciary, and before the Order both used a form of the word "audit".
- Sec. 10(2)(b) requires an independent data auditor to carry out a data audit and evaluate the fiduciary's compliance with the Act.
- Sec. 10(2)(c) lists other measures, including a periodic Data Protection Impact Assessment in sub-clause (i) and a periodic audit in sub-clause (ii).
The Order's recitals say the repetition created interpretive ambiguity, and the substitution makes sub-clause (ii) use the same "data audit" term as clause (b). The Order itself does not define "data audit", and this page does not supply a definition the Gazette does not.
The timing rule was not touched. Rule 13(1) requires a Significant Data Fiduciary, once in every period of twelve months from the date it is notified, to undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the Act and the Rules. Rule 13(2) requires the person carrying them out to furnish the Board a report of significant observations. The Significant Data Fiduciary entry sets out the three Sec. 10(2) duties, and the DPIA guide covers the assessment itself.
Why the Sec. 9(1) fix matters in practice
Before the Order, the opening of Sec. 9(1) read "a child or a person with disability", so the second category lacked the "of" that the first has. After it, the provision reads "of a child or of a person with disability", and the two categories are parallel.
The consent requirement is the same: verifiable consent of the parent of the child, or of the lawful guardian of a person with disability who has one. Rule 2(1)(d) defines verifiable consent by reference to Rule 10 (parent of a child) and Rule 11 (lawful guardian of a person with disability). For the definitions, see the child and person with disability section of the key definitions, and for how consent must be obtained, DPDP consent requirements.
What to do now
The Order calls for a document check, not a project.
- Search your privacy policy, internal DPDP policy, board papers and training material for quotations of Sec. 9(1) or Sec. 10(2)(c)(ii). Update the wording if you quote the Act verbatim.
- Check Data Processor and auditor contract templates that cite "periodic audit" as the statutory text.
- If you may be notified as a Significant Data Fiduciary, scope the independent data auditor engagement and the periodic data audit separately from the impact assessment, while planning all three against Rule 13's twelve-month cycle.
- Do not start a re-consent exercise because of this Order. It describes itself as textual and editorial, and it changes no date, Rule or Schedule. If a lawyer advises otherwise for your case, follow that advice.
For the wider list of duties, see Data Fiduciary obligations.