DPDP Removal of Difficulties Order 2026: What Changed for Guardian Consent and Data Audits

On 5 October 2026, MeitY quietly issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026. It was published in the Official Gazette on 7 October and took effect that same day. It changes a handful of words in the DPDP Act, and the government itself calls the changes "textual and editorial".

So why write a full post about it? Because the DPDP Removal of Difficulties Order 2026 touches two areas that many Indian SMEs and startups have been treating as someone else's problem: consent for persons with disabilities who have a lawful guardian, and the "data audit" duty of Significant Data Fiduciaries. Neither creates a new obligation. Both are good prompts to check whether your existing plans are pointed at the right target before the May 2027 deadline.

What the DPDP Removal of Difficulties Order 2026 actually changes

The Order was made under Section 43(1) of the DPDP Act, which lets the Central Government remove difficulties in giving effect to the Act. Any such order must be consistent with the Act, so this is a correction tool, not a back door for new rules.

It makes two amendments, as summarised by India Briefing and law firm King Stubb & Kasiva:

| Provision | Old wording | New wording | |---|---|---| | Section 9(1) | "personal data of a child or a person with disability" | "personal data of a child or of a person with disability" | | Section 10(2)(c)(ii) | "audit" | "data audit" |

One added preposition and one added word. That's the whole Order.

Section 9(1): consent for persons with disabilities is its own track

Section 9(1) requires a Data Fiduciary to obtain verifiable consent from a parent (for a child) or a lawful guardian (for a person with disability who has one) before processing their personal data. The fix makes it clear the provision applies to each group independently.

Here's why that matters in practice. Most SMEs that have thought about Section 9 at all have thought about children: age gates, parental consent flows, Rule 10 of the DPDP Rules, 2025. Far fewer have built anything for the second category. Rule 11 of the DPDP Rules covers it, and asks you to take reasonable care to check that the person claiming to be a lawful guardian actually is one, meaning a guardian appointed by a court or by a designated authority or local level committee under the guardianship laws the Rule refers to, such as the Rights of Persons with Disabilities Act, 2016 and the National Trust Act, 1999.

Who should care most:

• Healthtech and telemedicine platforms, where a guardian often manages records.
• Fintech and insurance apps that let a family member operate an account.
• Edtech, therapy and caregiving services serving adults with intellectual disabilities.

If your product lets one person act for another, ask a plain question: when a guardian signs up for an adult user, what proof do we ask for, and where do we keep it? If the answer is "we just trust the checkbox", that's the gap.

A practical fix doesn't need to be heavy. Add a guardian declaration step, collect a reference to the guardianship order or certificate, record who verified it and when, and keep that record alongside the consent log.

Section 10: "audit" now means "data audit"

The second change affects Significant Data Fiduciaries. Section 10(2) already requires an SDF to appoint an independent data auditor. Section 10(2)(c)(ii) separately required "periodic audit". The generic word left room to argue whether that meant a financial or IT audit. The Order settles it: it is a data audit, focused on data protection and processing compliance.

This lines up with Rule 13 of the DPDP Rules, 2025, which expects an SDF to carry out a Data Protection Impact Assessment and an audit once every twelve months and share the significant observations with the Data Protection Board.

"We're nowhere near being an SDF," you might say. Maybe. But the government designates SDFs by notification, weighing factors like the volume and sensitivity of data, risk to data principals and wider public-interest concerns. A fast-growing consumer app, a health platform or a lender processing lakhs of records could get there sooner than its founders expect. We covered how to self-assess in our earlier post on Significant Data Fiduciary status.

Even if you are never designated, enterprise customers and investors increasingly ask for evidence of an independent data protection review.

What a "data audit" should cover, at minimum:

1. Data inventory versus what you actually collect.
2. Notices and consent records, including guardian flows.
3. Retention and erasure.
4. Processor contracts and security safeguards.
5. Breach readiness, including the 72-hour report to the Board.
6. Data principal requests and grievances.

If your current "audit" plan is really a SOC 2 or ISO 27001 surveillance visit, that helps with safeguards but it isn't the same thing. A privacy impact assessment is a natural starting point for the DPIA half of Rule 13.

DPDP compliance timeline: where this sits

The DPDP Rules were notified on 13 November 2025 and are being phased in. The Data Protection Board provisions are already in force. The Consent Manager framework becomes operational around 13 November 2026, roughly five weeks from now. The core obligations, including notice, consent, Sections 9 and 10, data principal rights and breach notification, apply from 13 May 2027.

Penalties under the Schedule are real money: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹200 crore for breaching the additional obligations relating to children under Section 9.

The Order changes none of these dates or amounts. What it does show is that MeitY is actively tidying the text ahead of enforcement. Build on the plain words of the Act and Rules, not on hopes of a relaxation.

A short action list for this month

• Update your vocabulary. Replace generic "audit" references in your DPDP policies with "data audit" where you mean the Section 10 obligation.
• Map every "acting on behalf of" flow in your product and check that guardian verification exists for adults with disabilities, not only for children.
• Decide your SDF risk honestly and, if it's plausible, pencil in a first independent data audit for early 2027.
• Re-run your gap assessment against the full DPDP Act compliance requirements.

The Removal of Difficulties Order won't make headlines. It's the kind of quiet change that surfaces in a Board inquiry a year or two from now, when someone asks why a guardian was never verified. Fixing it now takes an afternoon.

---

This article is general guidance on the DPDP Act, 2023 and DPDP Rules, 2025, and is not legal advice. Please consult a qualified professional for your specific situation.

Want to know where you stand? Start with our free DPDP compliance checklist, or talk to the Primitra team about a data audit or guardian-consent review.