#MeitY Has Amended the DPDP Act by Order: Two Words, Two Sections, One Big Precedent

The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 has changed the text of the DPDP Act itself. Issued by MeitY on 5 October 2026 as S.O. 5458(E), it inserts one word into Section 9(1) and replaces another in Section 10(2)(c)(ii). Neither edit adds a new duty. Both settle ambiguities that compliance teams have been arguing over for two years, and the route MeitY used to make them is worth as much attention as the edits.

#What the Order actually changes

The Order makes two textual amendments:

• Section 9(1), children's data. The phrase "child or a person with disability" becomes "child or of a person with disability." The provision now reads as covering the personal data of a child, or of a person with a disability who has a lawful guardian.
• Section 10(2)(c)(ii), Significant Data Fiduciaries. The word "audit" becomes "data audit." The periodic audit an SDF must conduct is now expressly a periodic data audit.

According to FoxMandal's summary, MeitY describes both as textual, editorial corrections that align the provisions with legislative intent, and says both references to "audit" in Section 10 are meant to mean a data protection audit.

The Order is dated 5 October 2026 and takes effect on publication in the Official Gazette. Reports differ on the publication date: India Briefing says 7 October, while other outlets say 6 October. India Briefing's own summary table also says the amendments "apply from 5 October." Anyone citing the date in a policy document should pull the gazette copy rather than rely on secondary reporting. The S.O. number, 5458(E), is consistent across S.S. Rana & Co. and the TaxTMI notification listing.

#Why the missing "of" in Section 9(1) mattered

Section 9 is the DPDP Act's children's data provision. Read without the "of," the qualifier "who has a lawful guardian" could attach to both categories or only to the last one, and practitioners read the sentence both ways. The consequence was not trivial: it bears on whether verifiable consent from a parent or guardian is required for every child, or only for children who have a lawful guardian.

The insertion of "of" gives the child and the person with a disability separate standing, and ties the text to how the DPDP Rules, 2025 already treat them. Sansa Legal notes the correction lines up with Rules 10 and 11, which handle parental consent and guardian consent for persons with disabilities as separate tracks.

In practice, nothing changes for a platform that was already treating every under-18 user as needing verifiable parental consent. The change matters for the opposite case: a company that built its consent flow around a narrower reading and now has the Government's own wording against it. If your child-data logic is conditioned on whether a guardian is on record, the Order is a signal to revisit it. The same ambiguity has surfaced in product debates such as teen accounts on messaging apps, where the "no middle path" reading of Section 9 was already the safer one.

#Why "data audit" matters for Significant Data Fiduciaries

Section 10 imposes extra duties on Significant Data Fiduciaries: a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments and audits. The Act used the bare word "audit" in the periodic audit limb while using "data auditor" for the independent appointment. A literal reader could argue that "audit" pulled in a general statutory or financial audit.

The substitution closes that reading. Per FoxMandal, the periodic audit is about compliance with personal data processing, not the entity's affairs generally, and the independent data auditor requirement in Section 10(2)(b) is separate and unchanged. For SDFs, the practical scoping questions are:

1. Does your audit engagement letter describe a data audit, tied to DPDP obligations?
2. Are the independent data auditor's mandate and the periodic internal data audit documented as two distinct exercises?
3. Do your governance documents quote Section 10(2)(c)(ii) verbatim? If so, update the quotation.

One caution on third-party commentary: at least one law-firm note links audit frequency to Rule 8 of the 2011 IT Rules. That rule concerns security-practice audits, a different exercise, and the Order sets no audit frequency. Frequency remains a matter for the DPDP Rules and any SDF notification.

#What the Order does not change

The corrections are narrow, and it is worth being exact about the limits:

• No change to commencement. Sections 9 and 10 fall in the eighteen-month tranche of the Government's phased commencement, so they come into force around 13 May 2027. The amended provisions are not yet operative. Per Sansa Legal, the corrections were made to provisions that have not commenced.
• No new duty. Consent standards, age-verification mechanics and audit frequency are untouched.
• No SDF list. The criteria and notification for Significant Data Fiduciaries have still not issued, so most companies cannot yet say whether Section 10 applies to them.
• No Board. The Data Protection Board still has no reported Chairperson or Members, so there is no adjudicator to interpret any of this.

#The bigger question: amending an Act by executive order

Here is the part that deserves scrutiny. Section 43(1) allows the Central Government to make an order "not inconsistent with" the Act to remove difficulties in giving effect to its provisions. This is a standard Indian statutory clause, often called a Henry VIII clause, and it normally supports supplementary provision. Here it has been used to alter the Act's own words.

On these facts the case for the Order is strong: the edits are small, plainly corrective, and consistent with the Rules. But the precedent is wider than the edits. Per one analysis, such orders are time-limited and must be laid before Parliament under Section 43(3). Whether this one has been laid is not something we could confirm from the parliamentary record. A larger "difficulty" corrected the same way, for instance a substantive change to consent or SDF obligations, would raise real questions about the limits of delegated power, and a challenge would be a High Court or Supreme Court matter. For now, nobody has challenged this Order, and given what it does, nobody is likely to.

#Why the timing is awkward

The Order lands five weeks before consent manager registration opens and seven months before the main obligations commence. That is a tight window to learn that the statute's wording has moved under you. Companies that finalised child-consent designs or SDF audit scopes against the original text now have a short, cheap fix to make, but only if someone notices. The risk is not the edit; it is the compliance team that never reads the gazette and keeps quoting the old sentence in a board paper or a regulator-facing document next year.

It also shows the pattern to expect between now and May 2027. MeitY has been tidying the framework in small steps, while the larger open items remain unresolved: the SDF notification, the Board's composition, and the proposal to shorten the compliance window. Smaller corrections are the signal that officials are reading the Act closely. Treat each gazette notice, however modest, as a possible input to your compliance register.

#What Indian businesses should do now

The Order is low-stakes but not zero-stakes, and the timeline is short:

• Update documents that quote the Act. Privacy policies, consent notices, DPIA templates and audit charters that reproduce Section 9(1) or 10(2)(c)(ii) should carry the corrected text.
• Revisit child-data design. Treat the child and the person with a disability as separate consent tracks, and confirm your verifiable consent flow does not depend on a guardian being on file for children.
• Prepare for Rule 4. Consent manager registration opens on 13 November 2026, about a month away. If your consent architecture will plug into a consent manager, our consent manager guide sets out what to prepare.
• Plan for 13 May 2027. That is when the corrected Sections 9 and 10 bite, alongside the main compliance obligations and penalties. Our resources library has templates for DPIAs, audit scoping and parental consent flows.

#The takeaway

MeitY did the sensible thing: it fixed two drafting defects before the provisions came into force, rather than after the first dispute. The cost is a precedent. The Government has shown it will use Section 43 to edit the Act's text, and the next such order may not be as clearly editorial. Watch the gazette, not just the press releases, and build your compliance calendar around the dates that are fixed: 13 November 2026 for consent managers, and 13 May 2027 for everything else.

Sources used: official order metadata via TaxTMI; commentary from India Briefing, S.S. Rana & Co., FoxMandal and Sansa Legal. The Official Gazette text was not directly accessible; verify against it before relying on specifics.

Need to map your consent flows and SDF obligations before May 2027? Start with DPDPBot's resources and consent manager tools.