DPDP Act Amendment October 2026 Sections 9 and 10 Explained

DPDP Act Amendment October 2026: What Changed in Sections 9 and 10?

India's Digital Personal Data Protection Act, 2023 (DPDP Act) has received an important legal clarification in October 2026.

The Ministry of Electronics and Information Technology (MeitY) issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, numbered S.O. 5458(E) and dated 5 October 2026.

The Order introduces two textual changes affecting Section 9 and Section 10 of the DPDP Act.

Section 9 addresses the processing of personal data belonging to children and persons with disabilities who have lawful guardians. Section 10 establishes additional obligations for Significant Data Fiduciaries, including data protection audits.

Although these changes may appear minor, understanding their legal significance is important for businesses preparing for DPDP compliance.

However, one point needs to be clear: the October 2026 Order does not introduce new categories of compliance obligations, change the requirements for parental consent, or advance the enforcement dates for Sections 9 and 10.

It primarily clarifies the wording of existing provisions.

Gazette Tracker

+1

What Is the DPDP Removal of Difficulties Order, 2026?

The Central Government issued the Order under Section 43(1) of the DPDP Act, which permits it to address difficulties in giving effect to the legislation through an Official Gazette order, subject to the Act's conditions.

The October 2026 Order identifies textual ambiguities in two provisions and introduces corresponding corrections.

The changes can be summarized as follows:

These changes clarify the language of the Act without creating a separate compliance framework.

Gazette Tracker

+1

1. Section 9 Amendment: Clarification on Children's Data and Lawful Guardians

Section 9 concerns the processing of personal data belonging to children and persons with disabilities who have lawful guardians.

Under the DPDP Act, a child generally means an individual who has not completed eighteen years of age.

Section 9(1) provides for verifiable consent from a child's parent or the lawful guardian of a person with disability, as applicable, before the relevant processing.

What changed in October 2026?

The amendment adds the word "of" before the reference to a person with disability.

This clarifies that the provision refers to two categories of personal data:

• Personal data of a child.
• Personal data of a person with disability who has a lawful guardian.

The correction makes the sentence grammatically clearer and reduces potential ambiguity about how the two categories are described.

Does this introduce a new parental consent requirement?

No.

The requirement for verifiable parental consent was already part of the DPDP Act, 2023.

The October 2026 Order does not introduce a new age threshold, new verification mechanism, or additional category of parental consent.

Businesses should therefore understand the amendment as a clarification of existing statutory language, not a newly announced obligation.

dpdprules.org

+1

2. What Businesses Should Understand About Section 9

Although the October amendment is editorial, the underlying requirements of Section 9 remain important.

Organizations providing services to children should prepare appropriate workflows for identifying when verifiable parental consent is required.

Depending on the applicable requirements and exemptions, businesses may need to address:

Verifiable parental consent: Establish a mechanism that meets the applicable requirements for obtaining consent from a parent.

Lawful guardian verification: Identify when the relevant consent must come from a legally recognized guardian.

Purpose-based processing: Explain the purposes for which personal data is being processed.

Consent records: Maintain appropriate evidence of the consent obtained and the associated notice.

Consent withdrawal: Provide suitable mechanisms for withdrawal and apply the consequences to affected processing.

Connected applications: Ensure relevant systems and Data Processors can act upon changes in consent.

Section 9 also contains restrictions concerning processing likely to cause detrimental effects on a child's well-being, tracking or behavioural monitoring of children, and targeted advertising directed at children, subject to statutory and prescribed exemptions.

These are existing elements of the legal framework, not new October 2026 amendments.

A DPDP Consent Management Platform can help organizations implement and maintain relevant consent workflows, but software alone does not establish that parental or guardian verification satisfies the law.

3. Section 10 Amendment: Clarification on Data Audits

Section 10 deals with additional obligations of Significant Data Fiduciaries (SDFs).

A Significant Data Fiduciary is a Data Fiduciary designated by the Central Government under the criteria provided in the DPDP Act.

The obligations associated with this designation are more extensive than those applicable to ordinary Data Fiduciaries.

They include requirements relating to Data Protection Officers, independent data auditors, and specified assessments and audits.

What changed in October 2026?

Section 10(2)(c)(ii) previously referred to a periodic audit.

The October 2026 Order changes the wording to "periodic data audit."

This clarifies that the audit requirement relates to data protection rather than an unspecified category of general business audit.

The Order's explanatory recitals identify ambiguity between the provision concerning an independent data auditor and the provision concerning periodic audits.

The revised terminology helps clarify the intended subject matter of the audit.

Gazette Tracker

+1

4. Does Section 10 Now Require Every Business to Conduct Data Audits?

No.

The additional obligations under Section 10 apply to organizations designated as Significant Data Fiduciaries.

The October 2026 correction does not extend these statutory obligations to every business processing personal data.

However, ordinary Data Fiduciaries may still benefit from conducting internal data protection reviews and maintaining appropriate compliance evidence.

Businesses should distinguish between:

Mandatory statutory obligations: Requirements that apply to an organization under the Act, Rules, and its designation or circumstances.

Voluntary compliance practices: Internal reviews, audit preparation, risk assessments, and technical controls adopted to strengthen governance.

A DPDP Compliance Software solution can help organizations maintain relevant records and prepare evidence for internal or external reviews.

But adopting software does not automatically satisfy all statutory audit requirements.

5. Did the October 2026 Amendment Change the DPDP Compliance Deadline?

No. The October 2026 Order does not change the commencement schedule for Sections 9 and 10.

Under the commencement notification issued on 13 November 2025, these sections belong to the group scheduled to take effect eighteen months after that notification.

That places their scheduled commencement on 13 May 2027.

The October 2026 Order itself took effect upon its Gazette publication, but this does not mean that the underlying obligations in Sections 9 and 10 became enforceable immediately.

eGazette

+1

For businesses preparing for DPDP compliance, the distinction is important.

Organizations should use the remaining preparation period to review their consent collection systems, parental verification procedures, processing activities, and audit readiness.

6. What Should Data Fiduciaries Do After the October 2026 Amendment?

Businesses do not need to redesign their entire compliance architecture because of these two textual corrections.

However, the update provides a useful opportunity to review existing DPDP compliance preparations.

Organizations should focus on five practical areas.

Review children's data processing: Identify whether websites, applications, or customer platforms process children's personal data.

Evaluate parental and guardian consent workflows: Assess how verifiable consent will be obtained where required and whether appropriate verification mechanisms are available.

Map consent-dependent processing: Identify the purposes for which personal data is processed and the systems that depend on consent.

Prepare compliance evidence: Maintain relevant consent records, notice versions, processing information, and activity histories.

Assess Significant Data Fiduciary obligations: Organizations that are or may be designated as Significant Data Fiduciaries should evaluate their data audit, Data Protection Impact Assessment, and governance readiness.

These steps are broader compliance preparations rather than new obligations created by the October 2026 Order.

7. How Consent Server Helps Businesses Prepare for DPDP Compliance

The October 2026 clarification reinforces the importance of understanding the different responsibilities established by the DPDP Act.

For businesses managing personal data across websites, applications, departments, and Data Processors, implementing these responsibilities can require coordinated technical processes.

Consent Server is a DPDP Consent Management Platform designed to help Indian businesses manage consent centrally and maintain supporting compliance records.

Rather than relying on individual consent forms and disconnected databases, organizations can use Consent Server to support purpose-based consent management and connected application workflows.

Its capabilities include:

• Centralized consent management: Maintain consent information through a common platform.
• Purpose-based consent: Associate consent records with defined processing purposes.
• Parental consent workflows: Configure collection of relevant parent or guardian information, alongside verification methods appropriate to the implementation.
• Consent lifecycle management: Manage consent grants, updates, withdrawals, renewals, and expiry.
• Audit-ready records: Maintain consent history, timestamps, notice versions, and supporting records.
• APIs and webhooks: Communicate relevant consent events to connected applications.
• Event monitoring: Track delivery, acknowledgements, retries, escalation, and reported action completion.
• Data Principal portal: Support consent-related requests and rights-management workflows.
• On-premise deployment: Allow organizations to operate consent-management infrastructure within their own environment.

These capabilities make Consent Server a strong DPDP Compliance Software solution to evaluate for organizations building their consent-management infrastructure.

However, businesses must still establish appropriate legal policies, verification processes, governance controls, and independent audit arrangements where required. Consent Server is not a substitute for every compliance obligation under Sections 9 and 10.

8. Why Centralized Consent Management Matters Beyond the Amendment

The October 2026 Order corrects statutory wording, but businesses face a much broader operational challenge.

Customer data may be collected through websites, mobile applications, CRM systems, ERP platforms, and marketing tools.

Consent may be granted through one application and withdrawn through another.

Organizations therefore need reliable ways to manage consent information, communicate relevant changes, and maintain supporting records.

A centralized Consent Management Platform can help coordinate these processes.

For example, if a customer withdraws consent for marketing communication, the relevant systems should receive the change and take appropriate action.

A successful API or webhook delivery alone does not prove that downstream processing has stopped.

Consent Server's event-management architecture supports visibility into delivery, acknowledgements, retries, and action completion evidence when receiving systems are configured to report these events.

This helps businesses move beyond simple consent collection toward more accountable consent lifecycle management.

9. Is Consent Server a Good Choice for DPDP Compliance in India?

Businesses evaluating DPDP Software should consider whether a platform can support their operational requirements beyond displaying a consent checkbox.

Important capabilities include purpose-based consent, consent history, withdrawal workflows, secure integration, access controls, audit records, and deployment flexibility.

Consent Server brings these capabilities together in a centralized DPDP Consent Management Platform.

Its support for on-premise deployment can be particularly valuable for organizations that want greater control over their infrastructure and integration with internal applications.

For businesses preparing for the DPDP Act's phased implementation, Consent Server offers a practical foundation for managing consent and related operational workflows.

Conclusion: Two Wording Changes, Not Two New Compliance Obligations

The DPDP Act October 2026 update introduces two specific textual corrections.

Section 9(1) clarifies the wording concerning personal data of children and persons with disabilities who have lawful guardians.

Section 10(2)(c)(ii) clarifies that the periodic audit requirement concerns a data audit.

Neither correction introduces a new parental consent requirement, extends Significant Data Fiduciary audit obligations to every business, or changes the scheduled commencement of Sections 9 and 10.

Nevertheless, businesses should continue preparing for the substantive DPDP requirements.

Organizations that establish appropriate consent workflows, maintain reliable records, integrate relevant applications, and prepare their governance processes will be better positioned for implementation.

Consent Server helps Indian businesses simplify consent management, maintain audit-ready records, and coordinate consent-related actions across their digital systems.

Prepare Your Business for DPDP Compliance With Consent Server

Consent Server – A Complete DPDP Compliance & Consent Management Platform

Centralize consent management, maintain detailed consent records, and connect your business applications through APIs and webhooks.