Please click here to download the Prism as a PDF.
Digital Personal Data Protection Act, 2023: Ministry of Electronics and Information Technology clarifies consent and data audit requirements
On October 5, 2026, the Ministry of Electronics and Information Technology (“MeitY”) issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (“Order”). MeitY issued the Order under Section 43(1) of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) to address textual and editorial anomalies and clarify the scope of the relevant provisions.
Consent for persons with disabilities
The Order amends Section 9(1) of the DPDP Act to insert the preposition ‘of’ before ‘a person with disability’, clarifying that the provision applies to the processing of personal data of a child and of a person with disability who has a lawful guardian, and that verifiable consent is required for both categories.
Audits by significant data fiduciaries
The Order amends Section 10(2)(c)(ii) of the DPDP Act to replace the reference to ‘audit’ with ‘data audit’ in the periodic audit requirement that applies to significant data fiduciaries. This aligns the terminology with the data audit requirement under Section 10(2)(b) of the DPDP Act. It clarifies that the periodic audit is intended to be a ‘data audit’ or a ‘data protection audit’.
Conclusion
Overall, the Order removes the identified textual difficulties while retaining the substantive requirements and obligations under the DPDP Act. The industry is likely to welcome these clarifications. Stakeholders are also understood to have made representations to MeitY seeking greater clarity on many other provisions of the digital personal data protection framework. This is intended to support their preparations for the May 13, 2027, compliance deadline, with the industry continuing to anticipate greater clarity on these issues.
This Prism has been prepared by:
|
Probir Roy Chowdhury |
Yajas Setlur |
Rahul Rajasekar |
For more details, please contact km@jsalaw.com.
