India · India DPDP Act
India DPDP Order 2026: What Businesses Need to Know
India's DPDP (Removal of Difficulties) Order, 2026 clarifies the wording on consent for children and persons with disabilities who have lawful guardians, and specifies that Significant Data Fiduciaries must undergo a periodic data audit.
Effective October 6, 2026
What changed.
India’s Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarifies two provisions of the Digital Personal Data Protection Act, 2023. Published in the Official Gazette on 6 October 2026, it changes wording concerning consent for children and persons with disabilities who have lawful guardians, and periodic data audits by Significant Data Fiduciaries. Businesses should review their existing privacy procedures without assuming that the Order creates a new, standalone compliance regime.
What changed under the DPDP Order 2026?
The Ministry of Electronics and Information Technology issued the Order under the power to remove difficulties in implementing the Digital Personal Data Protection Act, 2023.
The Order addresses two provisions. The first concerns Section 9(1), which deals with processing personal data of children and persons with disabilities who have lawful guardians. The second concerns Section 10(2)(c)(ii), which addresses periodic audits by Significant Data Fiduciaries.
The government describes these changes as corrections to textual and editorial difficulties. Businesses should therefore distinguish between clarification of existing statutory wording and the introduction of a new substantive obligation.
Before and now
| Provision | Earlier wording | Change made by the Order |
|---|---|---|
| Section 9(1) | The wording referred to a child or a person with a disability who has a lawful guardian. | The text is amended to clarify the intended relationship between the two categories. |
| Section 10(2)(c)(ii) | The provision referred to a periodic audit. | The word audit is replaced with data audit. |
The Order does not replace the DPDP Act as a whole. It makes targeted textual changes to the two provisions identified in the Gazette notification.
Who does this affect?
The changes are relevant to businesses that process digital personal data and fall within the applicable requirements of the DPDP Act.
The consent-related amendment concerns the processing of personal data of children and persons with disabilities who have lawful guardians. Businesses operating digital services used by children, including applications, online platforms and software products, should check how their consent processes describe and address these categories.
The audit-related amendment is relevant to Significant Data Fiduciaries. The Act distinguishes this category from other Data Fiduciaries. Businesses should not assume that every company is a Significant Data Fiduciary or that every business must appoint an independent data auditor solely because this Order was issued.
Example scenario, not a real client: A software company offers an application that may be used by children. Its privacy team reviews its consent notice and supporting procedures. The team should check whether its wording reflects the amended provision and whether its processes align with the applicable statutory requirements. The Order alone does not establish that every software company needs to introduce a new consent system.
A separate example concerns a business that has been designated a Significant Data Fiduciary. It should review whether its audit documentation and internal procedures accurately refer to the required data audit. The precise steps depend on the requirements that apply to that business.
When does the Order take effect?
The Order was made on 5 October 2026 and published in the Official Gazette dated 6 October 2026. Its commencement provision states that it takes effect on the date of publication in the Gazette.
Businesses should distinguish the effective date of this Order from the commencement dates of the wider DPDP Act. The Order does not, by itself, bring every provision of the Act into force earlier than its separately notified commencement date.
The official text reviewed for this update establishes the Order’s publication and commencement dates. It does not establish that every business must complete a particular remediation exercise by a separate deadline under this Order.
What should a business do?
Businesses should consider the following practical steps.
- Review consent wording. Check notices and consent workflows that relate to personal data of children or persons with disabilities who have lawful guardians.
- Check the applicable statutory requirements. Review the relevant provisions of the DPDP Act and any applicable rules before changing a consent process.
- Review audit documentation. If the business is a Significant Data Fiduciary, check whether its audit procedures and records accurately reflect the amended wording.
- Confirm the business’s status. Do not assume that the audit-related requirements for Significant Data Fiduciaries automatically apply to every Data Fiduciary.
- Keep records of the review. Record the documents and processes examined, any changes made, and the reason for those changes.
These are practical review steps. The Order itself does not prescribe this exact checklist or require every business to amend every privacy document.
Documents that may need updating
The Order is narrow in scope. A business should review documents that relate directly to the amended provisions rather than rewrite its entire privacy documentation without a clear reason.
| Document or process | Suggested action |
|---|---|
| Privacy Policy | Check whether descriptions of consent and processing practices remain accurate. |
| Consent notices and workflows | Review wording and procedures relevant to the categories identified in Section 9(1). |
| Child data processing procedures | Check alignment with the applicable statutory requirements. |
| Data audit procedures | Significant Data Fiduciaries should review terminology and relevant procedures. |
| Data Processing Agreement | Check whether contractual descriptions of relevant responsibilities remain accurate. |
| Terms of Service and Cookie Policy | No direct amendment is established by this Order alone. |
Businesses reviewing their privacy documentation can explore My Legal Pal’s privacy policy drafting service and data processing agreement drafting service.
What is still unclear?
The Order makes two specific textual amendments. It does not answer every question about how the wider DPDP framework applies to individual businesses.
The Order does not itself provide a complete explanation of every method for obtaining verifiable consent, every exception that may apply, or every technical requirement for a data audit. Those questions require reference to the relevant provisions of the Act and applicable rules.
It also does not establish that all Data Fiduciaries are Significant Data Fiduciaries. Businesses should confirm their status and applicable obligations rather than apply the audit-related requirements indiscriminately.
The Order should therefore be read alongside the Act and other applicable official instruments. Businesses should not treat a wording clarification as proof that every existing consent or audit process is sufficient, or that a completely new process is automatically required.
Frequently asked questions
What is the DPDP Order 2026?
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 is a government order that amends the wording of two provisions of India’s Digital Personal Data Protection Act, 2023. It addresses wording concerning consent for children and persons with disabilities who have lawful guardians, and periodic data audits by Significant Data Fiduciaries.
Does the DPDP Order introduce new consent requirements?
The Order describes its amendments as corrections to textual and editorial difficulties. It clarifies the wording of Section 9(1), but the full consent requirements must be assessed by reading the Act and applicable rules together. The Order should not be described as introducing an entirely new consent regime on its own.
Does every business need to conduct a data protection audit?
The audit-related amendment concerns Significant Data Fiduciaries. The Order does not establish that every business must conduct an audit solely because the amendment was issued. Businesses should confirm whether they fall within the relevant category and review the requirements applicable to them.
When did the DPDP Order 2026 take effect?
The Order was made on 5 October 2026 and published in the Official Gazette dated 6 October 2026. It states that it takes effect on the date of publication in the Gazette.
Should businesses update their privacy policies?
Businesses should review their privacy policies, consent notices and relevant internal procedures to check whether they accurately reflect the applicable legal requirements. The Order does not expressly require every business to rewrite its privacy policy or amend all its data protection documents.
Businesses that need help reviewing their privacy documentation can contact My Legal Pal to discuss the requirements relevant to their operations.
Last reviewed: 23 October 2026
Written by Prakhar Rai, lawyer
The updates that apply to you.
Choose your regions and topics.