Digital Personal Data Protection Act, 2023: Government Clarifies Provisions on Consent and Data Audits

The Central Government has issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, making two textual amendments to the Digital Personal Data Protection Act, 2023 (“DPDP Act”). The Order was issued by the Ministry of Electronics and Information Technology on 5 October 2026 and published in the Gazette of India on 6 October 2026. It came into force on the date of its publication.

The Order does not introduce a new regulatory framework or alter the substantive architecture of the DPDP Act. Instead, it addresses two drafting issues identified by the Government: one concerning the processing of personal data of persons with disabilities who have a lawful guardian, and the other concerning the reference to “audit” in the obligations applicable to Significant Data Fiduciaries.

Why Has the Government Issued the Order?

Section 43(1) of the DPDP Act empowers the Central Government to make provisions, by an order published in the Official Gazette, where difficulties arise in giving effect to the Act, provided that such provisions are not inconsistent with the Act.

The Government has characterised the difficulties addressed by the 2026 Order as textual and editorial in nature. According to the notification, the amendments are intended to correct anomalies and give effect to the legislative intent of the relevant provisions.

The changes concern Section 9(1) and Section 10(2)(c)(ii) of the DPDP Act.

Clarification on Consent for Persons with Disabilities

Section 9(1) of the DPDP Act deals with the processing of personal data of children and persons with disabilities who have a lawful guardian.

The provision requires a Data Fiduciary, before processing such personal data, to obtain verifiable consent from the parent of the child or the lawful guardian, as the case may be, in the prescribed manner.

The Government identified a drafting issue in the wording of this provision. The original wording referred to “any personal data of a child or a person with disability”. The notification explains that the omission of the preposition “of” before “a person with disability” created a grammatical disjunction between the two categories and could obscure the intended parallel treatment of children and persons with disabilities.

The Order therefore substitutes the words “child or a person with disability” in Section 9(1) with “child or of a person with disability”.

The amendment is narrow in form, but it provides greater textual clarity to an important consent requirement. The provision now more clearly links the concept of “personal data” with both categories of individuals covered by it.

For organisations processing personal data relating to children or persons with disabilities with lawful guardians, the clarification is relevant because Section 9 imposes a specific consent framework rather than treating such processing in the same manner as ordinary personal data.

Clarification of the Audit Requirement for Significant Data Fiduciaries

The second amendment concerns Significant Data Fiduciaries (“SDFs”).

Section 10(2) of the DPDP Act contains obligations applicable to SDFs, including requirements relating to data audits. Under the provision, an SDF is required to appoint an independent data auditor to carry out a data audit. The Act also refers to periodic audits by Significant Data Fiduciaries.

The Government observed that the repeated use of the term “audit” could create uncertainty about whether the provisions contemplated two different categories or scopes of audit. The notification states that this could lead to ambiguity concerning the extent of the compliance obligation and potentially inconsistent application by regulatory or supervisory authorities.

The 2026 Order accordingly replaces the word “audit” in Section 10(2)(c)(ii) with “data audit”.

The amendment is intended to make clear that the audit referred to in the provision is a data audit, consistent with the broader audit-related framework applicable to Significant Data Fiduciaries.

What Does This Mean for Significant Data Fiduciaries?

The amendment is particularly relevant to organisations that fall, or may eventually fall, within the category of Significant Data Fiduciaries.

The Order does not create a new audit obligation. Rather, it clarifies the terminology used in the existing provision. The Government expressly states that both references to audit were intended to refer to a “data protection audit” or “data audit.”

This distinction is useful because audit-related obligations under a data protection framework can have significant implications for governance, documentation and accountability. By clarifying the terminology at the statutory level, the amendment reduces the scope for interpreting the two references as imposing materially different categories of audit.

At the same time, the Order itself does not prescribe a new audit methodology or set out additional operational requirements. Those matters would need to be considered with reference to the wider DPDP framework and the rules and requirements applicable to the relevant organisation.

The Order Takes Effect Immediately

An important aspect of the notification is its commencement provision.

The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 expressly provides that it comes into force from the date of its publication in the Official Gazette. Since the Order was published on 6 October 2026, the amendments take effect from that date.

This differs from an amendment that is expressly scheduled to commence at a later date. Organisations therefore need to read the amended wording as part of the DPDP Act from the date of Gazette publication.

A Targeted Clarification Rather Than a New Compliance Regime

The 2026 Order is relatively limited in scope. It does not rewrite the consent framework under the DPDP Act or establish a new category of data audit. Instead, it addresses two drafting issues that could otherwise create uncertainty in interpreting the statutory provisions.

The first amendment clarifies the grammatical and legal relationship between children and persons with disabilities who have lawful guardians under Section 9(1). The second makes the reference to “data audit” explicit in the obligations applicable to Significant Data Fiduciaries under Section 10(2).

The Government’s stated objective is to rectify textual anomalies in accordance with the legislative intent of the DPDP Act.

Conclusion

The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 provides a limited but useful clarification to the statutory text of the DPDP Act.

By inserting “of” in Section 9(1), the Government has clarified the drafting of the consent requirement concerning personal data of children and persons with disabilities who have lawful guardians. By replacing “audit” with “data audit” in Section 10(2)(c)(ii), it has clarified the nature of the audit contemplated for Significant Data Fiduciaries.

For businesses preparing for compliance with India’s emerging data protection framework, the Order is therefore best understood as a clarificatory amendment aimed at removing interpretive uncertainty, rather than as a new standalone set of data protection obligations.