S.O. 5458(E)
What the Removal of Difficulties Order actually does
Two words changed in the Act. Here is exactly what the Order does, the power behind it, and what it does not do.
Short answer
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), Gazette of India, 6 October 2026) makes exactly two editorial changes to the Act. It inserts 'of' in s.9(1), so it reads 'a child or of a person with disability', and changes 'audit' to 'data audit' in s.10(2)(c)(ii). It adds no new duty, and persons with disability who have a lawful guardian were already covered by s.9(1).
The two changes
The Order is made under s.43 of the Act, the removal of difficulties power. It was published in the Gazette of India on 6 October 2026 as S.O. 5458(E). Cite it by that number and date.
| Provision | Change | Effect |
|---|---|---|
| s.9(1) | Inserts 'of', so the text reads 'a child or of a person with disability' | Editorial; the duty to get verifiable consent of the parent or lawful guardian is unchanged |
| s.10(2)(c)(ii) | Changes 'audit' to 'data audit' | Editorial; the periodic audit duty for Significant Data Fiduciaries is unchanged |
Where the two provisions sit
s.9 covers children and persons with disability who have a lawful guardian. s.9(1) needs verifiable consent of the parent or lawful guardian; s.9(2) bars processing likely to cause a detrimental effect on a child's well-being; s.9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 sets the exemptions allowed by s.9(4) and s.9(5).
s.10(2) applies only to Significant Data Fiduciaries: a DPO based in India (s.10(2)(a)), an independent data auditor (s.10(2)(b)), and a periodic DPIA, periodic data audit and other measures (s.10(2)(c)). Rule 13 sets the DPIA and audit at once every twelve months. None of these duties changes; only the wording of s.10(2)(c)(ii) does.
Where the Order sits in the timeline
- 0111 August 2023
The Act is published in the Gazette (Act No. 22 of 2023).
- 0213 November 2025
The DPDP Rules, 2025 (G.S.R. 846(E)) are notified, with the commencement notification for the Act.
- 036 October 2026
The Removal of Difficulties Order, S.O. 5458(E), is published.
- 0413 November 2026
Rule 4, on Consent Manager registration, comes into force.
- 0513 May 2027
Core obligations begin under Rules 3, 5 to 16, 22 and 23.
What the Order does not do
- It adds no new duty for Data Fiduciaries or Significant Data Fiduciaries.
- It does not extend s.9 to persons with disability. Those who have a lawful guardian were already covered by s.9(1).
- It does not change when the Rules start: core obligations still begin on 13 May 2027 (Rule 1).
- It does not appoint Board members, designate SDFs or change penalties.
Reading s.9(1) correctly
s.9(1) requires verifiable consent of the parent before processing a child's personal data, and of the lawful guardian before processing the personal data of a person with disability who has one. That was already the position before the Order.
Rule 11 adds a check for the second case: before accepting consent from a lawful guardian, verify the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law. See our Rule 11 explainer.
If you read that the Order created a new duty for persons with disability, that reading is not right. Check the Gazette text of S.O. 5458(E) with counsel if a policy or contract relies on it.
What to do
- Update internal references from 'audit' to 'data audit' where you quote s.10(2)(c)(ii).
- Cite the Order alongside the Act when you quote s.9(1) or s.10(2)(c)(ii).
- If you keep a register of legal requirements, note the Order against s.9(1) and s.10(2)(c)(ii), with its S.O. number and Gazette date.
- Keep your programme plan as it is: the Order adds no task.
- Ask counsel to review any contract or policy that quotes the old wording.
How TruePrivacy helps
The SDF workspace runs yearly clocks for the DPIA, the data audit and algorithmic due diligence once you record a designation. Our SDF post explains those duties.
For children's data under s.9(1), guardian consent sends a consent request to the parent by email, has them verify with a code, and records the decision with a timeline and evidence.
What does S.O. 5458(E) change?
Two points of wording in the Act: it inserts 'of' in s.9(1) and changes 'audit' to 'data audit' in s.10(2)(c)(ii). Both changes are editorial.
Did the Order extend s.9 to persons with disability?
No. Persons with disability who have a lawful guardian were already covered by s.9(1). The Order only inserted 'of' in the text.
Under which power was the Order made?
Section 43 of the DPDP Act, the removal of difficulties power.
Does the Order add any compliance work?
It adds no new duty. Update internal references to the 'data audit' wording, and have counsel check any contract or policy that quotes the old text.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin