MeitY Issues DPDP Removal of Difficulties Order, 2026, Clarifying Consent and Data Audit Provisions

The Ministry of Electronics and Information Technology (MeitY) has issued the Digital Personal Data Protection (Removal of Difficulties) order, 2026, introducing two targeted textual changes to the Digital Personal Data Protection Act, 2023. Published in the Official Gazette on 7 October 2026, the Order addresses wording in provisions concerning consent for processing personal data and the audit obligations of Significant Data Fiduciaries (SDFs).  

The first change concerns Section 9(1), which addresses verifiable consent for processing the personal data of children and persons with disabilities who have lawful guardians. The order clarifies the statutory wording by inserting “of” before “a person with disability”, making the provision’s reference to the two categories grammatically parallel. It does not introduce a new consent requirement. 

The second change concerns Section 10(2)(c)(ii), where the term “audit” is replaced with “data audit”. This clarifies the nature of the periodic audit obligation applicable to Significant Data Fiduciaries and distinguishes it from a generic audit requirement. 

For organisations preparing for DPDP compliance, the order is a targeted clarification rather than a new standalone compliance framework. Businesses should review their consent procedures, privacy documentation and internal audit policies to ensure that they reflect the amended language. Significant Data Fiduciaries should also align their audit documentation with the clarified terminology. Importantly, the substantive obligations under Sections 9 and 10 are scheduled to take effect on 13 March 2027, under the phased implementation timeline. 

Read More: MeitY Issues DPDP Removal of Difficulties Order, 2026, Clarifying Consent and Data Audit Provisions 

📰 MINI HEADLINES 

• Kerala High Court Directs Centre to Make Data Protection Board Functional Within Eight Weeks 

The Kerala High Court has directed the Centre to make the Data Protection Board of India functional within eight weeks while considering a public interest litigation concerning the privacy of passenger data collected through Digi Yatra at airports. The petition raised concerns about the collection, storage and processing of passengers’ personal information, bringing questions of transparency, consent and accountability into focus. 

The proceedings highlight the importance of an effective grievance-redressal mechanism under the Digital Personal Data Protection Act, 2023. An operational Data Protection Board is central to the enforcement framework envisaged under the legislation, including the handling of complaints and the determination of alleged non-compliance. The Court’s intervention therefore draws attention to the gap between establishing a statutory regulator and ensuring that it can effectively discharge its functions. For organisations processing personal data, the development reinforces the importance of transparent data practices, appropriate safeguards and clear accountability mechanisms. 

READ MORE - Kerala High Court Directs Centre to Make Data Protection Board Functional Within Eight Weeks 

• New Zealand Privacy Commissioner Issues Compliance Notices Following Health Data Breaches 

New Zealand’s Privacy Commissioner has issued compliance notices to Manage My Health and Health New Zealand following security incidents involving health information. The notices address concerns regarding compliance with Rule 5 of the Health Information Privacy Code 2020, which requires agencies holding health information to implement reasonable security safeguards against loss, unauthorised access, use, modification or disclosure. 

The regulatory action highlights the heightened responsibility of organisations handling sensitive health information to maintain appropriate technical and organisational security measures. It also underscores that cybersecurity incidents can trigger regulatory scrutiny of an organisation’s existing safeguards and its response to identified vulnerabilities. For healthcare providers and digital health platforms, the notices reinforce the importance of regular security assessments, effective incident-response procedures and demonstrable compliance with applicable privacy requirements. 

READ MORE - New Zealand Privacy Commissioner Issues Compliance Notices Following Health Data Breaches 

• UK Government Announces Stronger Defences Against Emerging AI-Enabled Cyber Risks 

The UK Government has announced measures to strengthen national cybersecurity defences against emerging threats associated with artificial intelligence, including the potential misuse of increasingly autonomous AI systems. According to the government announcement, the measures respond to concerns that AI tools could accelerate vulnerability discovery and make cyberattacks more sophisticated, increasing the pressure on existing security mechanisms. 

The initiative highlights the growing importance of proactive vulnerability management, coordinated incident response and improved mechanisms for identifying and reporting serious AI-related security incidents. For organisations integrating AI into their operations, these developments reinforce the need to assess AI-specific risks alongside conventional cybersecurity threats, establish clear accountability for AI deployments and strengthen monitoring and response capabilities. As AI systems become more autonomous, effective security governance will be essential to managing risks that may arise from both malicious use and unintended system behaviour. 

READ MORE - UK Government Announces Stronger Defences Against Emerging AI-Enabled Cyber Risks