The Ministry of Electronics and Information Technology issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, under Section 43(1) of the Digital Personal Data Protection Act, 2023 (“DPDPA”) on 5 October 2026, to address textual and editorial ambiguities in Sections 9 and 10 of the DPDPA.
The Order introduces the following clarifications:
- Consent for Processing Personal Data of Children and Persons with Disabilities: Section 9(1) has been amended to insert the word “of” before “a person with disability” to rectify a textual omission that created ambiguity between the two categories and to clarify that Data Fiduciaries must obtain verifiable consent from the parent or lawful guardian, as applicable, before processing their personal data.
- Data Audits by Significant Data Fiduciaries: Section 10(2)(c)(ii) has been amended to replace the term “audit” with “data audit” to resolve interpretive ambiguity regarding the scope of audit obligations under Section 10(2)(b) and Section 10(2)(c)(ii), clarifying that both provisions refer to data protection audits and ensuring consistency in their interpretation and implementation.
The Order is effective from the date of its publication in the Official Gazette and seeks to ensure clarity and consistency in the interpretation and implementation of the DPDPA.