Vakil Help Desk News: the Government has issued the DPDP (Removal of Difficulties) Order, 2026, correcting the wording of two provisions on guardian consent and 'data audits'. We explain what changed and what to update.
Vakil Help Desk News, DPDP & Data Privacy. The Central Government has notified the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 under Section 43(1) of the DPDP Act, 2023. It makes two small textual corrections. These are clarifications, not new obligations — but businesses should align their documents with them.
What changed
- Consent (Section 9(1)): the wording is corrected so it clearly covers verifiable consent before processing the data of a child and of a person with disability who has a lawful guardian. No new consent category is created.
- Data audits (Section 10(2)(c)(ii)): the generic word 'audit' is replaced with 'data audit', making clear that a Significant Data Fiduciary's periodic audit duty concerns data-protection compliance and needs an independent data auditor.
Timing
The Order takes effect on publication. The core provisions it clarifies — Sections 9 and 10 — are part of the phased roll-out and are scheduled to apply from 2027, so there is time to prepare.
Why it matters
These edits remove ambiguity that could otherwise be argued about later. Getting your consent notices and audit paperwork to match the corrected language now avoids disputes once the provisions bite.
What this means for you
Update your consent flows and privacy notices to use the clarified wording for children and persons with disabilities, and — if you are (or may be designated) a Significant Data Fiduciary — make sure your governance, auditor engagement and checklists refer to a 'data audit' with an independent auditor. Fold this into your existing DPDP documents rather than a separate project. We review and update DPDP consent, notice and audit documentation.