The DPDP Removal of Difficulties Order: What Moves, What Doesn't

What changed

The Ministry of Electronics and Information Technology (MeitY) made the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), on 5 October 2026. It appeared in the Gazette of India Extraordinary, No. 5248, on 6 October 2026 and, under its paragraph 1(2), came into force on publication. It substitutes words in two clauses of the Digital Personal Data Protection Act, 2023 (the DPDP Act).

Section 9(1) requires a data fiduciary, the business that decides why and how personal data is processed, to obtain verifiable consent from a parent or lawful guardian before processing. Section 10(2) lists the extra duties of a Significant Data Fiduciary (SDF), a fiduciary the Central Government designates for the volume, sensitivity or risk of its processing.

The Order's own reasons. The preamble explains each fix. Without the second "of", the text "creates a disjunction between 'any personal data of a child' and the expression 'a person with disability'", disturbing "the intended parallelism between the two categories". On audits, "the repetition of the word 'audit' creates interpretive ambiguity regarding the scope of both categories of audit", and both references, the auditor's task under s.10(2)(b) and the periodic audit, "are intended to refer to a 'data protection audit' or 'data audit'". Both changes are said to follow "the legislative intent".

The power used

Section 43(1) lets the Central Government, "if any difficulty arises in giving effect to the provisions of this Act", make provisions by Gazette order "not inconsistent with the provisions of this Act". An order can clarify; in our view it cannot change policy. The two other limits sit in their own sub-sections, not in a proviso.

• Time limit, s.43(2). No order may be made "after the expiry of three years from the date of commencement of this Act". Section 1(2) reads a provision's reference to commencement as the coming into force of that provision, and s.43 came into force on 13 November 2025. In our view the window closes around 13 November 2028, about 18 months after the main duties begin, so difficulties found in early live compliance can still be fixed this way.
• Parliament, s.43(3). Every order is laid before each House "as soon as may be after it is made". Unlike s.41, which lets both Houses modify or annul rules and certain notifications, s.43(3) only requires laying. The Order did not wait for it.

What the Order does not change

• Dates. Sections 9 and 10 still commence on 13 May 2027 under G.S.R. 843(E), and consent manager registration on 13 November 2026. MeitY's January 2026 consultation on a shorter runway has not been notified.
• The Board. The Data Protection Board of India still has no reported appointments (Lok Sabha answer, 12 August 2026).
• The Rules. The DPDP Rules, 2025 are untouched. Rule 13(1) still requires an SDF to undertake a Data Protection Impact Assessment (DPIA) "and an audit" every twelve months; in our view that now reads as the data audit. Rule 11, on guardians, was already drafted on the corrected reading.
• Children-only protections. Section 9(2), on harm to well-being, and s.9(3), on tracking, behavioural monitoring and targeted advertising, still speak only of children. So does s.9(4), the power behind the Rule 12 exemptions.
• Penalties. The Schedule still describes its s.9 entry, up to ₹200 crore, as obligations "in relation to children". In our view a failure on the guardian route could be placed there or under the residual entry of up to ₹50 crore; plan for the higher figure.

Who is affected

Fiduciaries serving adults with lawful guardians. Banks, insurers, hospitals and mental health establishments, care homes, special schools and assistive-technology firms. Rule 11 requires due diligence that the guardian was appointed by a court, by a designated authority under the Rights of Persons with Disabilities Act, 2016, or by a local level committee under the National Trust Act, 1999. Rule 11(2) confines "person with disability" to someone who, despite adequate support, cannot take legally binding decisions, so most adults with disability consent for themselves. Trayambic's blog on verifiable parental consent sets out the evidence trail for both routes.

The sharper point is for hospitals and schools. Their Fourth Schedule relief from s.9(1) covers children's data only, because s.9(4) and Rule 12 speak only of children. An adult under guardianship has no equivalent exemption, so in our view the guardian route must be designed in, not assumed away.

SDFs and their auditors. No SDF had been designated by October 2026. For businesses expecting designation, the preamble settles that both audits in s.10 are data protection audits, not financial or general IT audits. Trayambic's whitepaper on Significant Data Fiduciaries covers what that audit should test.

What to do now

1. 1.Update your text. Replace quotations of ss.9(1) and 10(2)(c)(ii) in privacy policies, consent screens, DPIA templates and board papers, citing S.O. 5458(E).
2. 2.Find your guardian cases. List the journeys where an adult may act through a lawful guardian: account opening, claims, admissions, enrolment. Ask whether a guardian has been appointed, not whether the user has a disability.
3. 3.Build the Rule 11 check. Record the appointing body, the order's reference and its scope, verify before relying on the guardian's consent, and let the guardian withdraw as easily as consent was given.
4. 4.Test exemption assumptions. Hospitals, schools and care providers that rely on the Fourth Schedule for children should confirm that their adult cases under guardianship run on guardian consent.
5. 5.Scope one data audit. If designation is plausible, specify a single annual data audit by an independent auditor that serves s.10(2)(b), s.10(2)(c)(ii) and Rule 13, separate from statutory financial audits.
6. 6.Hold your dates. Plan to 13 May 2027, and watch the Gazette for Board appointments and further s.43 orders until late 2028.

Worked example (illustrative). A Kochi diagnostics chain with 40 collection centres serves about two lakh patients a year, some 300 of them adults whose families hold guardianship certificates from a local level committee. Its children's flow already collects parental consent. After the Order it adds a "Has a guardian been appointed?" question at booking, captures the certificate number and issuing committee, has a reviewer verify them before the guardian's consent is relied on, and sends reports to the guardian only within the certificate's scope.

Key takeaways

• The DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), made 5 October 2026, gazetted and in force 6 October 2026) changes the wording of s.9(1) and s.10(2)(c)(ii) only.
• Section 9(1) now reads 'of a child or of a person with disability', and the SDF's periodic audit is a 'data audit'; the preamble says both s.10 audits are data protection audits.
• Section 43(2) bars new orders three years after commencement; read with s.1(2), in our view that window closes around 13 November 2028.
• No date, rule, Board position or penalty moves: ss.9 and 10 still commence on 13 May 2027, and the children-only protections and Rule 12 exemptions do not extend to persons with disability.
• Fiduciaries serving adults under guardianship should build Rule 11 checks now, and likely SDFs should scope one independent annual data audit.