On 5 October 2026, the Ministry of Electronics and Information Technology issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (“Order“) under Section 43(1) of the DPDP Act 2023. The Order provides for two textual changes to the Digital Personal Data Protection Act, 2023 (“Act“), namely, to Section 9(1) and Section 10(2)(c)(ii) of the Act.
Section 43(1) of the Act confers upon the Central Government the power to remove any difficulties which may arise in giving effect to the law. Such provisions are a common feature of Indian legislation and are included in laws to help in their implementation.
Courts interpret these provisions as a narrow, implementation-focused ability given to the Government. This approach can be seen through the case of In re: Delhi Laws Act 1912 (1951 AIR 332), where the Supreme Court of India held that essential legislative functions cannot be delegated to the executive. In furtherance of this principle, Jalan Trading Co. v. Mill Mazdoor Union (1967 AIR 691) held that a ‘removal of difficulties clause’ cannot authorize the Government to modify the Act itself. Gammon India Ltd. v. Union of India (1974 AIR 960) similarly confirmed that such Orders may only be used to help the operation of the law and the law itself cannot be changed using these provisions. Therefore, any action taken to modify the Act, as detailed below, must be limited to the function of clarifying the law only.
Changes Introduced Through the Order
Section 9(1): consent required for data processing of a child or person with disability
Before the amendment, Section 9(1) of the Act required a Data Fiduciary, as defined in the Act, to obtain verifiable consent from a parent or lawful guardian before processing the personal data of “a child or a person with disability who has a lawful guardian” as the case may be. The Order prescribes the insertion of the word “of” and changes the Section to state that such consent will be required by a Data Fiduciary before processing the personal data of “a child or of a person with disability”. This grammatical insertion therefore presents the two as separate categories of Data Principals, as defined in the Act. Without the second “of”, one could argue that the qualifier “who has a lawful guardian” governs both limbs. A child’s data needs parental consent in every case, irrespective of any guardianship question, whereas a person with disability triggers the guardian-consent requirement only where a lawful guardian exists.
Under the current regime, Section 9 prescribes that obtaining the consent of the parent or lawful guardian is mandatory for a Data Fiduciary to process data of a child or a person with disability. It also prohibits the processing of any data which can harm the well-being of a child and any tracking, behavioural monitoring, or targeted advertising aimed at children. The manner of collecting consent for this Section is provided under Rules 10 and 11 of the Digital Personal Data Protection Rules, 2025 (“Rules“). Rule 10, for the processing of children’s personal data, requires the Data Fiduciary to verify the identity and age of the parent through information either available with the Data Fiduciary, information which was given by such parents voluntarily, or through “a virtual token mapped to such details, which is issued by an authorised entity”. Rule 11, for the processing of the personal data of a person with disability, who has a lawful guardian, requires that consent for the processing of data be obtained along with due diligence that the lawful guardian was duly appointed by a court, a designated authority or local level committee.
Section 10(2)(c)(ii): obligation to conduct “data audit”
Section 10 of the Act sets out the obligations of Significant Data Fiduciaries (SDFs). These obligations include, amongst others, the appointment of an independent data auditor to carry out a data audit, and as per Section 10(2)(c) undertaking periodic Data Protection Impact Assessments and conducting a “periodic audit”. The Order replaces this mention of “audit” with the term “data audit”. This amendment aligns this reference with the other obligations of SDFs and makes the Section read more consistently, thereby mitigating any misguided argument that a financial or general internal audit could discharge the obligation of the SDF under the provision.
Under the current regime, an SDF, as defined under Section 2(z) of the Act, is a Data Fiduciary or a class of Data Fiduciaries notified by Central Government under Section 10 of the Act based on factors including but not limited to the volume and/or sensitivity of the data it processes, the risk caused to the rights of Data Principal, its potential impact on the sovereignty and integrity of India, and many more. Because of this elevated status, the Act places more requirements for SDFs to comply with, including the conduction of data audits.
Conclusion: Intent and Effect of the Amendment
Valid consent is one of the most essential features of the Act and is a mandatory requirement for data collection, processing or sharing under the Act. The Sections which have been clarified in the Order, namely Sections 9 and 10, both reflect the consent and accountability framework of the Act. Section 9 provides for the collection of consent for Data Principals whose consent cannot be directly obtained, i.e., children and persons with disabilities who have lawful guardians, and Section 10 provides for the additional obligations for SDFs due to their position as elevated Data Fiduciaries and includes the obligation of conducting data audits to ensure strict compliance with the law. Since the two Sections are extremely important features of the Act, all risks of misinterpretation must be mitigated.
By refining wording alone, both amendments leave the substantive consent and audit obligations unchanged and preserve the existing data protection regime. Their effect is thus clarificatory rather than legislative. Accordingly, the insertion of a single word in Section 9(1) and one word in Section 10(2)(c)(ii) does not change the law and is thereby consistent with the administrative limits that are placed for the purpose of removal of difficulties. Ultimately, while the words inserted are small, their role in securing clarity, consistency and effective compliance under the Act is significant.
English
Chinese (Simplified)
Japanese