MeitY has issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated 5 October 2026, published in the Gazette on 6 October 2026) under Section 43(1) of the DPDP Act. It makes two wording fixes. Section 9(1) now clearly says verifiable consent is needed before processing personal data 'of a child or of a person with disability who has a lawful guardian'. Section 10(2)(c)(ii) now says 'periodic data audit', matching the independent data auditor in Section 10(2)(b). The Order adds no new duties and does not change any deadline: Sections 9 and 10 and most other duties still apply from 13 May 2027.
| Who is affected | Businesses that process personal data of children or of persons with disability (edtech, healthcare, insurance, gaming, social platforms), and large companies likely to be notified as Significant Data Fiduciaries. |
|---|---|
| What to do | Plan guardian verification for persons with disability (Rule 11) alongside parental consent for under-18s (Rule 10). If you may be a Significant Data Fiduciary, scope your annual data audit and impact assessment (Rule 13) now. Nothing changes in your 13 May 2027 deadline. |
| Source | Ministry of Electronics and IT (Gazette of India) |
This is a plain-language summary for general information, not legal or tax advice. The court order or official document is the authoritative text. Ask an expert how it applies to you.