Removal of Difficulties Order Corrects the DPDP Act on Children's Consent and Significant Data Fiduciary Audits
Background and Facts
The Central Government has exercised its power to remove difficulties under the Digital Personal Data Protection Act, 2023. The Removal of Difficulties Order, made through the Ministry of Electronics and Information Technology and dated October 5, 2026, corrects two pieces of text in the Act: a missing preposition in the children's consent provision, and the description of the periodic audit a Significant Data Fiduciary must undertake. The Order comes into force on its publication in the Official Gazette.
Neither correction changes an obligation. Both are reported by the Ministry as textual corrections, and the practitioner interest lies less in what they alter than in what they confirm about how the Act is to be read and about the route the Government has chosen to fix it.
No gazette number for the Order is carried consistently across the sources available at the time of writing, so none is cited here. The Order is reported on October 8, 2026 by four independent outlets, which agree on its name, its maker, its date and its contents.
Key Legal Issue
Whether a defect in the printed text of a statute can be cured by executive order, and if so on what terms. Section 43 of the Act answers both questions and sets the limits within which this Order has to sit.
The Power the Order Rests On
Section 43(1) provides that if any difficulty arises in giving effect to the provisions of the Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of the Act as may appear to it to be necessary or expedient for removing the difficulty.
Two limits follow in the same section and both matter here. Section 43(2) provides that no such order shall be made after the expiry of three years from the date of commencement of the Act. The Act commenced on November 13, 2025, so the window runs to November 2028 and this Order is comfortably inside it. Section 43(3) requires every order made under the section to be laid before each House of Parliament as soon as may be after it is made, which means the Order is subject to parliamentary scrutiny rather than being the last word.
The Children's Consent Correction
Section 9(1) as printed requires the data fiduciary, before processing any personal data of a child or a person with disability who has a lawful guardian, to obtain verifiable consent of the parent of such child or the lawful guardian, in such manner as may be prescribed. The Order inserts the word of, so that the provision reads child or of a person with disability.
The effect is grammatical rather than substantive, but it removes a reading that could have caused trouble. Without the preposition, the phrase can be read as a single composite subject, which would suggest the sub-section bites only where a child also has a lawful guardian. With it, the two categories stand separately, which is how rule 10 and rule 11 of the Digital Personal Data Protection Rules, 2025 already treat them: rule 10 deals with verifiable consent for a child, and rule 11 separately with the lawful guardian of a person with disability.
The Significant Data Fiduciary Audit Correction
The second correction replaces the word audit with data audit, in the second of the two audit references in section 10. That is the reference to the periodic audit a Significant Data Fiduciary is required to undertake, as distinct from the appointment of an independent data auditor which the same section separately requires.
The practical reading is that the periodic exercise is a data audit rather than an audit at large, so its scope is the observance of the Act and the rules in relation to personal data, not the entity's affairs generally. Section 10 already pairs that periodic exercise with a periodic Data Protection Impact Assessment, and the correction aligns the language of the Act with what the exercise was always about.
What the Order Does Not Do
It does not bring anything forward. Both corrected provisions sit in the eighteen month tranche under the commencement notification G.S.R. 843(E) dated November 13, 2025, which brought sections 3 to 5, most of section 6, and sections 7 to 17 into force eighteen months after publication. Sections 9 and 10 are in that group, so the Order corrects text that has not yet commenced.
It also does not widen either obligation. The consent mechanism in section 9 is untouched, and the audit duty in section 10 is neither enlarged nor made more frequent. Any advisory that presents this Order as a new compliance requirement is reading it wrongly.
Practice Notes
In practice, the Order calls for housekeeping rather than redesign:
Update anything that quotes section 9(1) verbatim: Template consents, internal registers and client advisories that reproduce the printed wording now carry superseded text. The substance is unchanged, so this is a reprint rather than a re-paper.
Separate the two categories in design, not just in drafting: The corrected reading matches rule 10 and rule 11, which prescribe different verification routes for a parent and for a lawful guardian. A single combined gate does not satisfy both.
Scope a Significant Data Fiduciary audit to data: With the periodic exercise described as a data audit, an engagement letter that commissions a general compliance audit is wider than the provision requires, and wider scope is harder to report on.
Keep the independent data auditor distinct: Section 10 requires the appointment of an independent data auditor and separately requires the periodic exercise. One person may do both only if the independence requirement is still met.
Do not cite a gazette number you cannot open: Reporting of this Order is not consistent on its number. Describe it by name, maker and date until the gazette copy is available.
Watch for the laying before Parliament: Section 43(3) requires it, and an order laid is an order that can be questioned. Diarise the session rather than treating the text as settled.
Key Provisions Discussed
Section 9 of the Digital Personal Data Protection Act, 2023: Verifiable consent of the parent or lawful guardian before processing the personal data of a child or of a person with disability who has a lawful guardian, together with the bars on detrimental processing and on tracking, behavioural monitoring and targeted advertising directed at children.
Section 10 of the Act: The additional obligations of a Significant Data Fiduciary, including the appointment of a Data Protection Officer and of an independent data auditor, and the periodic assessment and audit which this Order describes as a data audit.
Section 43 of the Act: The power to remove difficulties by order published in the Official Gazette, limited to provisions not inconsistent with the Act, exercisable only within three years of commencement, and requiring every order to be laid before each House of Parliament.
Order Details
Instrument: Digital Personal Data Protection (Removal of Difficulties) Order, 2026
Maker: Central Government, through the Ministry of Electronics and Information Technology
Power: Section 43 of the Digital Personal Data Protection Act, 2023
Dated: October 5, 2026
Commencement: On publication in the Official Gazette
Effect: Inserts the word of in section 9(1), and substitutes data audit for audit in the periodic audit reference in section 10
Not affected: The consent mechanism, the scope of the audit duty, and the commencement of either provision
Sources and References
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments