DPDP (Removal of Difficulties) Order 2026: What Changed for Children’s Data and SDF Audits

In early October 2026 the Ministry of Electronics and Information Technology (MeitY) issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)). It is the first time the government has used the power in Section 43(1) of the DPDP Act 2023, which lets it make provisions, consistent with the Act, to remove difficulties in giving effect to the law.

The Order is dated 5 October 2026 and was published in the Gazette shortly after. Commentators cite 6 or 7 October as the publication date.

What the Order changes

There are two textual edits, both in provisions that are not yet in force:

Provision	Before	After
Section 9(1): children and persons with disability	"...personal data of a child or a person with disability..."	"...personal data of a child or of a person with disability..."
Section 10(2)(c)(ii): Significant Data Fiduciaries	"...periodic audit..."	"...periodic data audit..."

MeitY describes both as textual and editorial corrections meant to reflect legislative intent. They do not add a new compliance regime.

Why one word matters in Section 9(1)

Without the second "of", the sentence could be read as treating "a child or a person with disability" as a single class, so the verifiable-consent duty for persons with disability would only bite when the person was also a child. The corrected text makes the two categories run in parallel:

• For a child (under 18), verifiable consent of the parent, and
• For a person with disability who has a lawful guardian, verifiable consent of that lawful guardian.

This matches what Rules 10 and 11 of the DPDP Rules 2025 already assumed. If your consent architecture was designed only around age-gating, it now plainly needs a guardian pathway as well. See our deeper guide: Verifiable consent for children and persons with disability after the 2026 Order.

Why "data audit" matters for SDFs

Section 10 requires a Significant Data Fiduciary (SDF) to appoint an independent data auditor and carry out periodic audits. "Audit" on its own invited the question of whether a statutory financial audit, an ISO 27001 surveillance audit or an internal audit could be counted. "Data audit" closes that door: the audit must test compliance with the DPDP Act and Rules specifically. We cover what that audit should look like in How to prepare for the SDF data audit.

What the Order does not do

• It does not change any commencement date. Sections 9 and 10 still switch on with the bulk of the Act's obligations, 18 months after the Rules were notified on 13 November 2025.
• It does not change the penalty schedule (up to ₹200 crore for children's-data failures, up to ₹150 crore for SDF failures).
• It does not touch the Rules themselves.

What to do this quarter

1. Update policy language. Search your privacy notice, consent copy, DPIA templates and auditor engagement letters for "audit" and "child or person with disability" and align them to the amended wording.
2. Add a guardian-consent flow to your consent design backlog if you serve users who may have a lawful guardian.
3. Scope the data audit separately from your financial and ISMS audits if you are, or may be notified as, an SDF.

Vidhi, Data Adhikaar's regulatory-intelligence agent, picked this Order up from the Gazette and mapped it to affected controls automatically. Check your overall position with the free readiness assessment.

This article reflects the position as of 15 October 2026 and is not legal advice.