Centre Issues DPDP Removal of Difficulties Order, Corrects Wording of Sections 9 and 10

The Ministry of Electronics and Information Technology (MeitY) has issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)), dated 5 October 2026 and published in the Gazette of India on 6 October, the day it came into force. MeitY made the Order under Section 43(1) of the Digital Personal Data Protection Act, 2023 (DPDP Act), which allows the Centre to make provisions, by an order published in the Official Gazette, to remove difficulties in giving effect to the Act. The Order changes two phrases. In Section 9(1), it inserts the word "of" so that the provision now covers the personal data "of a child or of a person with disability who has a lawful guardian". In Section 10(2)(c)(ii), the "periodic audit" that a Significant Data Fiduciary must carry out becomes a "periodic data audit".

Neither change adds a duty or moves a deadline. Sections 9 and 10 still come into force on 13 May 2027, eighteen months after the commencement notification of November 2025. Read strictly, the original Section 9(1) could be taken to speak of processing "a person with disability" rather than that person's data. With the repeated "of", the guardian-consent rule plainly attaches to the personal data of a person with disability, just as it does to a child's. The Section 10 change aligns clause (c)(ii) with clause (b), which already requires a Significant Data Fiduciary to appoint an independent data auditor to carry out a "data audit". So the periodic audit is that data audit, not a general security or financial audit. Rule 13 of the DPDP Rules, 2025 sets its frequency at once every twelve months.

The choice of instrument deserves attention. Section 43 exists to clear practical obstacles in implementing a new law, and it permits only provisions "not inconsistent with the provisions of this Act". Here MeitY has used it to change the wording of two sections of the Act itself, a job Parliament usually does through a Repealing and Amending Act. I would argue the Order is defensible because both changes restore what the provisions were plainly meant to say. The method should not become routine, though. Section 43(3) requires every such order to be laid before each House of Parliament, and Section 43(2) bars any order after three years from commencement, so Parliament remains the proper place for anything more than a drafting fix.

For organisations, the practical reading is short. Schools, hospitals, ed-tech platforms and disability service providers should build guardian-consent flows for the data of persons with disabilities with the same care they give to children's data. Significant Data Fiduciaries should scope their annual audit as a data audit by an independent auditor under Section 10(2)(b), and budget for it now rather than in the months before May 2027.