DPDP Removal of Difficulties Order 2026, S.O. 5458(E): what changed in sections 9 and 10

The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 is the first instrument this site has registered under section 43 of the DPDP Act. It is 2 operative paragraphs long. It adds 1 word to section 9(1) and 1 word to section 10(2)(c)(ii), it creates no new obligation on this site's reading, and it does not move the date on which either section starts to apply to anyone.

It was found on 9 October 2026 by this site's tripwire on MeitY's document library, which listed it twice that day. Here are both of its substitutions and its commencement paragraph word for word, what each change does to the reading, and the 3 dates its Gazette print carries.

Diagram headed "S.O. 5458(E): the words it changed in the DPDP Act, and what it left alone", subtitled as the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, made under section 43(1) of the Act. A band identifies the Order, dated 5 October 2026, as printed in Gazette issue No. 5248, whose printed masthead is dated 6 October 2026, and in force on the date of its publication in the Official Gazette under paragraph 1(2). A left panel headed paragraph 2(i), section 9(1), sets the words as printed in 2023, "any personal data of a child or a person with disability who has a lawful guardian", above the words as modified by S.O. 5458(E), "any personal data of a child or of a person with disability who has a lawful guardian", with the added "of" in bold, and records as this site's reading that the Order quotes the old words with a comma after disability that the Act's print does not have. A right panel headed paragraph 2(ii), section 10(2)(c)(ii), sets "periodic audit" as printed in 2023 above "periodic data audit" as modified, notes that clause (b) already read "data audit" and is left untouched, and records as this site's reading that the Order does not say the clause (b) audit and the clause (c)(ii) audit are one exercise. A bottom band headed what the Order does not change lists 3 things: commencement, because sections 9 and 10 are in the 18 month group of G.S.R. 843(E) and are not in force as at 10 October 2026, a group that on the printed Gazette date computes to 13 May 2027, an interpretation until officially confirmed; no rule, because the DPDP Rules 2025 are not named in the Order, so Rule 10 and Rule 13 are untouched by it; and no new duty on this site's reading, with the recitals calling the difficulties "textual, editorial in nature".

The Order in 1 table

The words in the rows for the 2023 print and the modified text are quoted from the Act's Gazette print and from the Order, and the recital row quotes the Order's recitals; the last row is the commencement status this site gives every provision, and the computed date in it is an interpretation until officially confirmed.

The 3 dates on 1 Gazette print

The Order's own date line reads "New Delhi, the 5th October, 2026". The Gazette issue that prints it, No. 5248, carries a masthead dated Tuesday, 6 October 2026. The CG code stamped on the same page embeds 07102026, and the digital signature on the print is dated 7 October 2026.

What decides commencement is the date of publication, not the date the Order was made, because paragraph 1(2) reads:

"It shall come into force on the date of its publication in the Official Gazette."

Paragraph 1(2) of S.O. 5458(E), Gazette page 3.

This site dates publication by the printed masthead, so it records the Order as in force from 6 October 2026. That is the same choice its registry makes for the Act's commencement notification and for the DPDP Rules, whose issues carry the same 1 day gap between masthead and code, and it is a reading rather than a certified fact: the code and the signature both point to 7 October 2026. Nothing in either section turns on the difference, because neither section is in force. MeitY's library lists the Order under 9 October 2026, which is the date of its library record and not a Gazette date.

Change 1: section 9(1) gains the word of

Section 9(1) is the duty to obtain verifiable consent before processing the personal data of a child or of a person with disability who has a lawful guardian. Paragraph 2(i) of the Order reads:

"in section 9, in sub-section (1), for the words “ child or a person with disability,” the words “child or of a person with disability ”shall be substituted;"

Paragraph 2(i) of S.O. 5458(E), Gazette page 3, including its spacing as printed.

As modified by S.O. 5458(E), section 9(1) therefore reads "The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed." Only the added word differs from the 2023 print.

The second recital gives the Government's reason:

"the omission of the preposition “of” before the expression “a person with disability” creates a disjunction between “any personal data of a child” and the expression “a person with disability,” thereby obscuring the intended parallelism between the two categories and the clarity of legal intent"

Second recital to S.O. 5458(E), Gazette page 2.

On this site's reading, the printed sentence could be parsed as "any personal data of a child", or "a person with disability", as though the person rather than their personal data were the thing processed. The added word makes both categories objects of the same phrase: personal data of a child, or personal data of a person with disability who has a lawful guardian. Whose consent is needed does not change. It is still the verifiable consent "of the parent of such child or the lawful guardian, as the case may be", so for a person with disability the consent is the lawful guardian's.

The comma the Order quotes and the Act does not print

Paragraph 2(i) tells the reader to find the words "child or a person with disability," with a comma after disability. Section 9(1) as printed in the Act, in the MeitY Gazette print at page 8 and in the India Code consolidated print, has no comma there: it runs straight on into "who has a lawful guardian". The Order's own first recital restates section 9(1), and does so without the comma.

Read literally, the words the Order names do not occur in the Act. This site applies the substitution to the words without the comma and leaves the rest of the sentence as printed, which is what the section 9 page publishes, with the 2023 print kept behind a disclosure. That is this site's reading of an instruction that does not match the print exactly. It is not an official statement, and no corrigendum to the Order has been located in MeitY's library as enumerated on 9 October 2026.

Change 2: section 10(2)(c)(ii) becomes periodic data audit

Section 10(2) lists what a Significant Data Fiduciary must do once it has been notified as one. Clause (b) is to "appoint an independent data auditor to carry out data audit". Clause (c) then lists "other measures", and sub clause (ii) was printed as "periodic audit". Paragraph 2(ii) reads:

"in section 10, in sub-section (2), in clause (c), in sub-clause (ii), for the word “audit”, the words “data audit” shall be substituted;"

Paragraph 2(ii) of S.O. 5458(E), Gazette page 3.

So sub clause (ii) now reads "periodic data audit", matching the words clause (b) already used. The fourth recital explains why:

"the repetition of the word “audit” creates interpretive ambiguity regarding the scope of both categories of audit and a need has been felt to clarify the scope of the compliance obligation and prevent inconsistent application by regulatory or supervisory authorities, and in keeping with the object of the said Act, clarify that both references to audit are intended to refer to a “data protection audit” or “data audit”"

Fourth recital to S.O. 5458(E), Gazette page 2.

The recital speaks of "both categories of audit", and the Order does not say they are one exercise. It names no audit standard, method or report format, and it does not touch Rule 13, which sets the 12 month cycle. On this site's reading, the change narrows the room to argue that "periodic audit" in clause (c) meant some other kind of audit, because the fourth recital says both references are intended to refer to a "data protection audit" or "data audit". The Act does not define data audit. What a data audit must contain is unpacked in the data protection audit article, and the full set of Significant Data Fiduciary duties in the SDF obligations article.

The power the Order uses

The Order recites section 43(1):

"If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as may appear to it to be necessary or expedient for removing the difficulty."

Section 43(1), Gazette page 19.

The test the text sets is "not inconsistent with the provisions of this Act". The sixth recital describes the difficulties being removed as "textual, editorial in nature", and records a need to rectify the anomalies in section 9(1) and section 10(2)(c)(ii) "in accordance with the legislative intent". Whether a removal of difficulties order can change the words of the Act itself is a question about the reach of section 43 that the Order does not discuss and that this site does not answer. What can be said from the text is narrower: the Order states the power it uses, and both of its changes repeat or align words already in the same sections.

It is a different instrument from the corrigenda to the DPDP Rules, G.S.R. 892(E) of December 2025. That instrument corrected a printed notification under the heading corrigenda and recited no power. This one recites section 43(1), carries its own short title and commencement, and changes the words of the Act rather than of the Rules.

How long the power lasts, and the laying duty

Section 43(2) puts a limit on the power:

"No order as referred to in sub-section (1) shall be made after the expiry of three years from the date of commencement of this Act."

Section 43(2), Gazette page 19.

The DPDP Act did not commence on 1 date, and section 1(2) says how to read a phrase like this one: "any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision". Section 43 came into force on publication of G.S.R. 843(E), clause (a), whose Gazette issue is printed 13 November 2025. On that reading the last day an order can be made computes to 13 November 2028. That is an interpretation until officially confirmed, and it inherits the 13 or 14 November question about the Act's commencement date. A reader who takes commencement of this Act to mean the last group to commence would arrive at a later date. Section 1(2) points to the first reading, but this site has located no official statement confirming either.

Section 43(3) adds a laying duty:

"Every order made under this section shall be laid, as soon as may be after it is made, before each House of Parliament."

Section 43(3), Gazette page 19.

It fixes no number of days, and unlike section 41, which governs every rule, and every notification under sections 16 and 42, it says nothing about either House modifying or annulling the order. No record of this Order being laid before either House is held in this site's source registry as at 10 October 2026. That is a statement about this site's records and not about Parliament; the duty runs "as soon as may be", and this site will record a laying when it locates one.

What the Order does not change

• When sections 9 and 10 apply. Both are in clause (c) of G.S.R. 843(E), the 18 month group, so neither is in force as at 10 October 2026. On the printed Gazette date of 13 November 2025 that group computes to 13 May 2027, an interpretation until officially confirmed. The Order says nothing about commencement, and changing the words of a provision does not bring it into force.
• The Rules. The Order names the Act only. Rule 10, on verifiable consent for children and persons with disability, and Rule 13, on the Significant Data Fiduciary audit cycle, read exactly as they did before it.
• Who is a Significant Data Fiduciary. An entity becomes a Significant Data Fiduciary only if the Central Government notifies it under section 10(1), which says "may notify", and no such notification has been located in MeitY's library or this site's source registry as of 7 October 2026.
• The penalties. Entries 3 and 4 of the Schedule to the Act, for breach of the section 9 and section 10 obligations, are not touched.
• Any other provision. Paragraph 2 modifies nothing outside section 9(1) and section 10(2)(c)(ii).

What to do with it

Our recommendation, not a requirement of either instrument: if a policy, contract or notice quotes section 9(1) or section 10(2)(c)(ii) word for word, quote the modified text and name S.O. 5458(E) beside it, because a reader checking against the 2023 Gazette print will otherwise find a difference. If a document only paraphrases those provisions, nothing needs to change. Neither section binds anyone yet, so there is no compliance step that the Order brings forward.

The modified text of both sections is on section 9 and section 10, the Order itself is listed on the documents page, and its place in the sequence of DPDP instruments is on the timeline.