DPDP Removal of Difficulties Order 2026 Explained

What the Order is

On 5 October 2026 the Ministry of Electronics and Information Technology issued S.O. 5458(E) — the Digital Personal Data Protection (Removal of Difficulties) Order, 2026. The Order is made under Section 44 of the Digital Personal Data Protection Act, 2023, which gives the Central Government a power to make orders removing difficulties in giving effect to the provisions of the Act, for up to three years from the date the Act was brought into force.

The Order makes two targeted wording changes to the Act. It does not change any commencement date, does not expand the Act's scope and does not create any new obligations. For a privacy programme planning toward 13 May 2027, the Order is a small-but-specific input to the Section 9 (children's data) and Section 10 (Significant Data Fiduciary) workstreams. Everything else — notice, consent, DSR, breach notification, Chapter VIII penalties, Consent Manager registration under Rule 4 — proceeds unchanged.

Change 1: Section 9(1) and persons with disability

The pre-amendment Section 9(1) imposed verifiable-consent and specific-prohibition duties where the Data Fiduciary processes 'the personal data of a child'. The Order amends this to read 'the personal data of a child or of a person with disability'. The practical effect is that, from the Act's commencement on 13 May 2027, a Data Fiduciary processing the personal data of a person with disability must obtain the verifiable consent of their lawful guardian — in the same way as for a child — and must observe the Section 9 bans on behavioural tracking, targeted advertising directed at the individual, and processing likely to cause detrimental effect on wellbeing.

Rule 10 of the DPDP Rules 2025, which operationalises verifiable parental consent, was not re-notified alongside the Order. It applies to both categories by reference. The verification methods — government-ID verification coupled with a sworn declaration, financial-instrument verification, video-call verification, or verification through a government-issued digital-identity service — now serve as 'reasonable confidence' standards for identifying both the parent of a child and the lawful guardian of a person with disability. The Order does not define 'person with disability'; the generally accepted reference in Indian law is the Rights of Persons with Disabilities Act, 2016.

Operationally this expands the scope of the Section 9 regime but does not change the mechanics. Fiduciaries that have built an age-gate at account creation, a parental-consent workflow for users identified as children, and a periodic audit of advertising audiences for leakage into child-flagged accounts have most of the infrastructure needed. The new requirement is to extend 'child-flagged' to 'child-or-person-with-disability-flagged' and to extend the parental consent flow to a guardian consent flow, with appropriate adjustments to the verification method menu where the guardian relationship is different in kind from the parent-child one.

Change 2: 'periodic data audit' for Significant Data Fiduciaries

The pre-amendment Section 10(2)(c)(ii) obliged a Significant Data Fiduciary to undertake 'periodic audit' as prescribed. The Order amends this to 'periodic data audit'. The clarification removes ambiguity about scope — the audit is specifically a data audit, not a general compliance audit — and lines the Indian regime up with the data-audit language used in sectoral regulation and in international frameworks such as ISO/IEC 27701 and the EDPB-aligned data-audit guidance.

The substantive duty is unchanged. Rule 13 of the DPDP Rules 2025 (in force 13 May 2027) continues to require the SDF to appoint an independent data auditor, conduct the audit on a periodic cadence, cover processing activities, consent flows, DSR workflows, breach history, security controls and SDF-specific controls such as DPIAs and algorithmic risk assessments, and furnish the audit report on request. The auditor must be independent; the Act does not create a Board-maintained auditor panel.

The practical effect for prospective SDFs: the audit scope and the auditor qualification can now be framed as 'data audit' terms rather than 'compliance audit' terms, which simplifies vendor selection and scope negotiation. Audit providers that offer ISO 27701-style data audits, or GDPR-aligned DPIA review and data-flow verification, map cleanly onto the Section 10(2)(c)(ii) requirement. The 'periodic' cadence is prescribed by Rule 13 rather than left open; a mature SDF's audit timeline will align the Rule 13 cadence with its existing ISO/SOC audit calendar to minimise audit fatigue on the business.

What the Order does not change

No dates moved. The three-phase commencement is unchanged: Board provisions and rule-making powers from 13 November 2025; Consent Manager registration under Rule 4 from 13 November 2026; sections 3–17 of the Act and most of the Rules — notice, consent, Data Principal rights, security safeguards, breach reporting, Significant Data Fiduciary duties, cross-border transfers and the Chapter VIII penalty schedule — from 13 May 2027. The MeitY Secretary's October 2026 statement that the eighteen-month timeline is final (reported by IAPP) remains the position; the Order does not reset the clock.

No new scope. The Order does not expand the Act to new categories of data, new types of Fiduciary or new activities. It does not notify any Significant Data Fiduciary, does not restrict any country for cross-border transfer, and does not change any penalty band. Section 44's authority is to remove difficulties in giving effect to the Act — not to amend the Act substantively.

No new rules. The Order is not a Rule and does not amend the Rules. It is a Section 44 Order that reworded two provisions of the primary Act. The corrigendum G.S.R. 892(E) of 16 December 2025 remains the one amendment to the DPDP Rules 2025 published to date. Any further rule changes will come through fresh notifications under Section 40 (general rule-making) or further Section 44 Orders.

What to update in your DPDP programme

Four workstreams carry a small update because of the Order.

Notice copy. The Section 5 notice content that references children should be extended to reference 'a child or a person with disability' where the processing may touch either category. The 22-language Eighth Schedule translations need the corresponding update. For most Data Fiduciaries operating general-audience services this is a copy edit, not a structural change.

Consent flow. The verifiable-parental-consent workflow should be extended to a 'verifiable guardian consent' workflow with appropriate guardian relationship verification. The Rule 10 methods map onto both parent-of-child and guardian-of-person-with-disability; the identity verification tier may need adjustment where the guardian relationship evidence differs from the parent-child evidence (powers of attorney, guardianship orders, etc.).

SDF plan. Where you are an SDF or expect designation, the audit workstream should be scoped as a 'data audit' rather than a 'compliance audit' and the auditor qualification criteria updated. If you have already engaged a data audit provider in anticipation of Rule 13, the scope letter can be updated to cite 'Section 10(2)(c)(ii) periodic data audit' rather than the earlier 'periodic audit' phrasing.

DPIA inventory. For processing involving children, the DPIA scope should be extended to include processing of persons with disability where that category is in the user base. The Rule 10 and Section 9 analysis should extend to both categories; where it exists only for 'child', add 'and persons with disability' to the scope.

FAQ

Does the Removal of Difficulties Order change the May 2027 deadline? No. The Order makes two wording changes and leaves the 13 May 2027 commencement for sections 3–17 and the Chapter VIII penalty schedule unchanged.

Is a 'periodic data audit' different in substance from a 'periodic audit'? No. The Order's purpose is clarification. Rule 13 of the DPDP Rules 2025 defines the audit scope — processing activities, consent flows, DSR, breach history, security controls, SDF-specific controls — and that scope is unchanged. The reworded label makes the audit's data-centric focus explicit in the primary Act.

Does 'person with disability' use the RPwD Act 2016 definition? The Order does not define the term, so the generally accepted reference in Indian law is the Rights of Persons with Disabilities Act, 2016. The Data Protection Board may provide its own definition when it issues procedural regulations; until then, the RPwD Act definition is the operating assumption.

Is there any grace period for implementing the updated Section 9 for persons with disability? No. The amended Section 9(1) commences on 13 May 2027 together with the rest of the Act's core duties. There is no separate commencement date for the amended text.

Sources

DPDP (Removal of Difficulties) Order 2026, S.O. 5458(E) of 5 October 2026, published on the MeitY document portal (meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf). Analysis via Trayambic (trayambic.com/resources/blogs/dpdp-removal-of-difficulties-order-2026-what-changes). DPDP Rules 2025 (Rule 10 verifiable parental consent, Rule 13 periodic data audit). Rights of Persons with Disabilities Act, 2016. IAPP, 'Notes from the Asia Pacific region: key developments in India's digital policy landscape' (iapp.org).

This post was last reviewed on 1 November 2026 by Fizer Khan (LowerPlane).