The DPDP Order 2026 introduces important clarifications to India’s digital personal data protection framework. Issued by the Ministry of Electronics and Information Technology (MeitY), the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 addresses specific wording issues in Sections 9 and 10 of the Digital Personal Data Protection Act, 2023. The Order was issued on October 5, 2026, and published in the Official Gazette on October 7, 2026.
The changes mainly concern the processing of personal data relating to children and persons with disabilities who have lawful guardians, as well as the data-audit obligations applicable to Significant Data Fiduciaries (SDFs). Although the amendments are targeted and textual, businesses should understand what they mean for their privacy policies, consent processes and data-governance practices.
What Is the DPDP Order 2026?
The DPDP Order 2026 is a removal-of-difficulties order issued under Section 43(1) of the Digital Personal Data Protection Act, 2023.
The Order makes two specific amendments to the Act:
- It clarifies the wording of Section 9(1) concerning personal data of children and persons with disabilities who have lawful guardians.
- It changes the word “audit” to “data audit” in Section 10(2)(c)(ii), which relates to Significant Data Fiduciaries.
The Government has described these changes as textual and editorial corrections intended to remove ambiguity and give effect to the legislative intent of the Act.
Importantly, businesses should not treat the Order as an entirely new data-protection law. Instead, it provides greater clarity around specific provisions of the existing DPDP framework.
DPDP Order 2026: What Has Changed?
The Order focuses on two provisions of the DPDP Act.
1. Clarification of Section 9(1)
Section 9(1) deals with processing personal data of a child or a person with a disability who has a lawful guardian.
The wording has been changed from:
“child or a person with disability”
to:
“child or of a person with disability”
This change clarifies that the provision applies in parallel to both categories. The Order explains that the earlier wording could create a grammatical disjunction and obscure the intended legislative meaning.
The underlying requirement remains important for businesses. Where the relevant provision applies, the Data Fiduciary must obtain verifiable consent from the parent of the child or the lawful guardian, as applicable.
2. Clarification of Data Audit Requirements
The second amendment concerns Significant Data Fiduciaries.
Section 10 already contains obligations relating to data audits and the appointment of an independent data auditor. The DPDP Order 2026 changes the reference to “audit” in Section 10(2)(c)(ii) to “data audit.”
The purpose is to clarify that the periodic audit requirement relates specifically to data protection and data-processing compliance rather than an unspecified general audit.
How the DPDP Order 2026 Affects Indian Businesses
The practical effect of the Order will depend on the type of personal data a business processes and whether the organisation is subject to the additional obligations applicable to a Significant Data Fiduciary.
Businesses should use this development as an opportunity to review their existing privacy and data-governance framework.
Areas worth reviewing include:
- Privacy policies
- Consent mechanisms
- Age-verification processes
- Parental or guardian consent procedures
- Data-processing records
- Data governance policies
- Data-audit procedures
- Vendor agreements
- Employee privacy procedures
- Internal compliance documentation
The objective should be to ensure that legal requirements and actual business processes remain aligned.
1. Review Consent for Children’s Data
Businesses that provide services to children should pay particular attention to their consent mechanisms.
The DPDP framework requires appropriate verifiable consent before processing personal data covered by Section 9. The 2026 clarification does not create a completely new consent requirement, but it removes ambiguity from the wording of the provision.
Businesses should review:
- How age is determined
- How parental consent is obtained
- How consent is verified
- How consent records are maintained
- How consent withdrawal is handled
- Whether privacy notices accurately explain the process
This is especially important for online platforms, educational services, gaming businesses, social platforms and other digital services that may process children’s personal data.
2. Review Data Relating to Persons With Disabilities
The clarification also expressly addresses personal data relating to a person with a disability who has a lawful guardian.
Businesses should check whether their existing privacy procedures appropriately address such situations.
Where applicable, organisations should ensure that:
- The lawful guardian is properly identified.
- Consent procedures are appropriately documented.
- Internal teams understand the applicable process.
- Privacy notices use clear and accurate terminology.
- Data-processing records reflect the actual process followed.
The objective is not simply to update the wording of a policy. Businesses should ensure that their operational processes support the legal requirements.
3. Review Data-Audit Processes
The second major area affected by the DPDP Order 2026 is data auditing.
Significant Data Fiduciaries have additional obligations under Section 10 of the DPDP Act. The clarification makes it clear that the relevant periodic requirement is a data audit.
An organisation preparing for this requirement should review whether its audit framework examines issues such as:
- Personal data collected
- Purpose of processing
- Data sources
- Consent mechanisms
- Data retention
- Data sharing
- Security controls
- Data-processing activities
- Third-party processors
- Privacy governance
A data audit should provide meaningful insight into how an organisation handles personal data and whether its processes align with applicable requirements.
4. Update Privacy Policies and Compliance Documents
Legal changes should be reflected consistently across an organisation’s documentation.
Businesses should review their:
- Privacy policies
- Internal data-protection policies
- Consent notices
- Customer-facing notices
- Employee privacy documentation
- Vendor agreements
- Data-processing agreements
- Compliance checklists
- Audit documentation
The terminology used in these documents should be consistent with the DPDP Act and the DPDP Order 2026.
5. Review Third-Party Data Processors
Businesses frequently rely on external service providers to process personal data.
These may include:
- Cloud providers
- CRM platforms
- HR software
- Payment service providers
- Marketing platforms
- Analytics providers
- Customer-support platforms
- SaaS providers
Companies should identify which vendors have access to personal data and review whether contractual and operational controls are appropriate.
A privacy compliance programme is difficult to maintain if third-party data processing is not properly monitored.
6. Understand Significant Data Fiduciary Obligations
The DPDP Order 2026 is particularly relevant to organisations that are or may be classified as Significant Data Fiduciaries.
Such organisations have additional obligations under the DPDP Act, including requirements connected with data audits and independent data auditors.
Businesses in this category should consider strengthening:
- Data governance
- Privacy risk assessments
- Data-audit procedures
- Compliance documentation
- Internal accountability
- Vendor oversight
- Security controls
The exact requirements applicable to a particular organisation depend on its status and the provisions in force at the relevant time.
7. Do Not Treat the Order as a Completely New Compliance Regime
One of the most important points for businesses is that the DPDP Order 2026 is limited in scope.
It does not establish a completely separate data-protection regime. The Government describes the amendments as textual and editorial corrections intended to remove difficulties and clarify legislative intent.
Therefore, companies should not assume that they need to build an entirely new compliance system because of this Order.
Instead, businesses should update their existing DPDP compliance programme where necessary.
8. Prepare for DPDP Implementation
The DPDP framework is being implemented in phases.
Businesses should therefore avoid waiting until every provision becomes operational before beginning compliance preparation.
Organisations can use this period to:
- Map personal data
- Identify sensitive business processes
- Review consent mechanisms
- Assess third-party processors
- Update privacy documentation
- Establish governance responsibilities
- Develop audit procedures
- Train employees
- Review contractual arrangements
Early preparation can reduce the risk of rushed compliance changes later.
9. Build a Practical DPDP Compliance Checklist
Businesses can use the DPDP Order 2026 as a trigger for a broader privacy compliance review.
Data Governance
- Identify personal data collected by the organisation.
- Document the purpose of each processing activity.
- Identify internal and external users of personal data.
- Review data retention practices.
Consent
- Review existing consent mechanisms.
- Check applicable parental or guardian consent procedures.
- Maintain appropriate consent records.
- Review withdrawal mechanisms.
Privacy Documentation
- Update privacy notices.
- Review internal privacy policies.
- Check customer-facing consent notices.
- Ensure documents match actual processing activities.
Third-Party Processing
- Identify external data processors.
- Review data-processing agreements.
- Conduct vendor due diligence.
- Review access to personal data.
Data Audits
- Review data-audit procedures.
- Define the scope of relevant audits.
- Maintain appropriate audit evidence.
- Review independent auditor arrangements where applicable.
10. What Should Indian Businesses Change Now?
Businesses should focus on reviewing and strengthening existing processes rather than reacting as though the DPDP Order 2026 creates an entirely new law.
The most useful immediate actions include:
- Review consent procedures for children and persons with disabilities where applicable.
- Update references in privacy policies and compliance documents.
- Review data-audit frameworks for Significant Data Fiduciaries.
- Examine third-party data-processing arrangements.
- Update internal DPDP compliance checklists.
- Identify gaps between documented policies and actual business practices.
- Train relevant employees.
- Maintain evidence of compliance activities.
- Monitor further DPDP regulatory developments.
- Prepare for the relevant implementation dates.
2026 DPDP Compliance: Key Takeaways
The DPDP Order 2026 is a targeted development, but it provides an important opportunity for Indian businesses to review their data-protection practices.
The key changes are:
- Section 9(1) has been clarified concerning children and persons with disabilities who have lawful guardians.
- The wording now refers to personal data “of a child or of a person with disability.”
- Section 10(2)(c)(ii) now uses the term “data audit” instead of “audit.”
- The clarification is particularly relevant to Significant Data Fiduciaries.
- Businesses should review consent processes and privacy documentation.
- SDFs should review their data-audit frameworks.
- The Order does not create an entirely new compliance regime.
How Derecho Consulting Can Help
DPDP compliance requires more than simply publishing a privacy policy.
Businesses need to understand what personal data they collect, why they collect it, how it is processed, who has access to it and how compliance responsibilities are managed.
Derecho Consulting can assist businesses with:
- DPDP compliance assessments
- Privacy policy reviews
- Data-mapping exercises
- Consent-management reviews
- Data-processing agreement reviews
- Vendor privacy due diligence
- Data governance frameworks
- Data-audit readiness
- Compliance documentation
- Privacy and regulatory advisory
A structured approach can help businesses identify compliance gaps and strengthen their privacy governance before those gaps create legal or operational problems.
Conclusion
The DPDP Order 2026 provides targeted clarification to India’s evolving data-protection framework. The changes address the wording of Section 9 concerning children and persons with disabilities and clarify the nature of the periodic data-audit requirement for Significant Data Fiduciaries.
For Indian businesses, the right response is not to create an entirely new compliance framework. Instead, organisations should review their existing privacy, consent, data-governance and audit processes and make the necessary updates.
As India’s DPDP framework continues to develop, businesses that establish strong data governance and maintain clear compliance documentation will be better positioned to manage their privacy obligations.
For businesses, the message is simple: review your data practices now, document your compliance processes and prepare before the applicable obligations become operational.