The Digital Personal Data Protection Act, 2023 (DPDP Act) sets out the legal framework for processing and protecting digital personal data in India. The Act lays down obligations for Data Fiduciaries, including obtaining verifiable consent before processing the personal data of children and persons with disabilities who have lawful guardians, and imposes additional compliance requirements on Significant Data Fiduciaries.
To address certain ambiguities in the statutory language, the Ministry of Electronics and Information Technology (MeitY) issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, dated October 5, 2026, and published in the Official Gazette on October 6, 2026. The Order introduces two changes to Sections 9(1) and 10(2)(c)(ii) of the DPDP Act, relating to consent requirements and data audits. These changes are intended to clarify the legislative intent, remove interpretative difficulties and ensure consistency in the application of the Act.
Clarification of Consent Requirements Under Section 9(1)
Section 9(1) of the DPDP Act requires a Data Fiduciary to obtain verifiable consent from the parent of a child or the lawful guardian of a person with disability, as applicable, before processing their personal data, in the manner prescribed under the law.
Earlier Provision
Section 9(1) referred to the processing of “any personal data of a child or a person with disability who has a lawful guardian”. The absence of the word “of” before “a person with disability” created a grammatical inconsistency between the two categories. This omission further affected the intended parallel construction of the provision and could give rise to ambiguity regarding its interpretation.
Revised Provision
The Order substitutes the words “child or a person with disability” with “child or of a person with disability”. Therefore, the relevant portion now reads as “any personal data of a child or of a person with disability who has a lawful guardian”.
The insertion of the word “of” clarifies that Section 9(1) applies to the processing of personal data belonging to two separate categories, i.e., children and persons with disabilities who have lawful guardians. The change ensures consistency in the language of the provision and reinforces that Data Fiduciaries must obtain verifiable consent from the respective parent or lawful guardian before processing such personal data.
However, the clarification does not introduce any additional consent requirements or alter the existing statutory obligations. It is intended to remove grammatical ambiguity and ensure that the provision is interpreted in accordance with its original legislative intent.
Clarification of Data Audit Requirements Under Section 10(2)(c)(ii)
Section 10 of the DPDP Act lays down additional obligations for Significant Data Fiduciaries. Under Section 10(2)(b), a Significant Data Fiduciary must appoint an independent data auditor to carry out a data audit. Section 10(2)(c)(ii) additionally requires the periodic conduct of audits.
Earlier Provision
Section 10(2)(c)(ii) required Significant Data Fiduciaries to undertake a “periodic audit”. However, Section 10(2)(b) specifically referred to a “data audit”, whereas Section 10(2)(c)(ii) used the broader expression “audit”.
The difference in terminology created uncertainty regarding whether the provisions referred to the same type of audit or imposed distinct audit-related compliance obligations. The Government identified the need to clarify this distinction to prevent inconsistent interpretation and application by regulatory or supervisory authorities.
Revised Provision
The Order substitutes the word “audit” in Section 10(2)(c)(ii) with “data audit”. Accordingly, the provision now expressly refers to “periodic data audit”.
The substitution clarifies that the audits under both Section 10(2)(b) and Section 10(2)(c)(ii) relate to data protection or data audits. This provides better clarity regarding the scope of audit-related compliance obligations imposed on Significant Data Fiduciaries and reduces the possibility of the provisions being interpreted as referring to different categories of audits.
The requirement to appoint an independent data auditor under Section 10(2)(b) and the obligation to perform periodic data audits under Section 10(2)(c)(ii) remain unchanged. The revised terminology aligns the provisions and provides consistent regulatory interpretation.
Conclusion
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 addresses two drafting ambiguities relating to verifiable consent and data audit requirements under the DPDP Act. By clarifying the scope of Section 9(1) and aligning the audit-related terminology under Section 10(2), MeitY has aimed to ensure greater consistency and certainty in the interpretation of these provisions. Although the changes are limited to statutory wording and do not create additional compliance obligations, they provide useful clarity for Data Fiduciaries and Significant Data Fiduciaries in understanding their responsibilities under the DPDP Act.
Authors: Manisha Singh and Shivi Gupta