The Ministry of Electronics and Information Technology (MeitY) has issued an order correcting the text of two provisions of the Digital Personal Data Protection Act, 2023. No new obligation has been created and no deadline has moved. What has changed is the wording of Section 9(1) and Section 10(2)(c)(ii).
On paper, the edits look minor. One adds the word “of”. The other adds the word “data”. But in a statute, a single word decides who an obligation applies to and what it covers. Both corrections close a gap that could have been argued either way once the Data Protection Board begins hearing matters.
Here is what each change does, and what it means for your compliance programme.
| Provision | Earlier wording | Corrected wording |
|---|---|---|
| Section 9(1): consent for children and persons with disability | “personal data of a child or a person with disability” | “personal data of a child or of a person with disability” |
| Section 10(2)(c)(ii): audit by Significant Data Fiduciaries | “periodic audit” | “periodic data audit” |
Change 1: Section 9(1) now separates children from persons with disability
Section 9(1) requires a Data Fiduciary to obtain verifiable consent before processing the personal data of a child, or of a person with disability who has a lawful guardian. For a child, consent comes from the parent. For a person with disability, it comes from the lawful guardian.
The earlier text read “personal data of a child or a person with disability who has a lawful guardian”. Read quickly, the qualifier “who has a lawful guardian” could be stretched to cover both groups. That reading would suggest parental consent is needed only for children who have a lawful guardian, which was never the intent.
By repeating “of”, the corrected text makes two distinct categories:
- Every child (anyone under 18) needs verifiable parental consent before their data is processed. There is no condition attached.
- A person with disability falls under Section 9(1) only where a lawful guardian has been appointed. Here, the guardian gives consent on their behalf.
This also lines up the Act with the DPDP Rules, 2025, which already treat the two groups separately. Rule 10 deals with verifiable consent for children, using reliable identity and age details or a virtual token, such as one issued through DigiLocker. Rule 11 deals with persons with disability, and requires the Data Fiduciary to check that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law.
An example. Take an online learning platform with two new sign-ups in the same week.
The first is a 15-year-old student. Under the corrected Section 9(1), there is no room to argue about guardianship. The platform must verify that the person giving consent is an identifiable adult and the student’s parent, before it processes any of the student’s data.
The second is a 34-year-old learner with a visual impairment who manages their own affairs and has no appointed guardian. Section 9(1) does not apply to them. They consent for themselves, like any other adult, and the platform’s job is to make the notice and consent flow accessible.
If the second learner instead had a guardian appointed under, say, the National Trust Act, 1999, the platform would need the guardian’s consent and would have to verify the appointment before going ahead.
The practical point: your consent flows should not ask one question (“is this a minor or a person with disability?”) and route both answers into the same parental-consent journey. They are two journeys, with two different verification steps.
Change 2: Section 10(2)(c)(ii) now says what kind of audit
Section 10 sets out the extra duties of a Significant Data Fiduciary (SDF). Under Section 10(2)(b), an SDF must appoint an independent data auditor to carry out a data audit and evaluate its compliance with the Act. Under Section 10(2)(c), it must also undertake a periodic Data Protection Impact Assessment and, until now, a “periodic audit”.
That bare phrase left a question open. Large companies already run many audits: statutory financial audits, internal audits, IT general controls reviews, ISO 27001 surveillance audits. Could an SDF point to one of these and say it had met the requirement?
The correction to “periodic data audit” answers that. The audit in clause (c)(ii) is the same kind of audit described in clause (b): an independent review of how the organisation processes personal data, measured against the DPDP Act. Rule 13 of the DPDP Rules, 2025 sets the rhythm. An SDF must carry out the DPIA and the audit once every twelve months, and the person conducting them must give the Data Protection Board a report with their significant observations.
In short, a financial audit or a generic security certificate does not tick this box. Those reviews can feed into the data audit, but they cannot replace it.
An example. Consider a private bank that the Central Government notifies as an SDF because of the volume and sensitivity of the customer data it handles.
The bank already has an ISO 27001 certificate and passes its statutory audit every year. Before the correction, its compliance team might have argued that these covered the “periodic audit”. After it, the position is clear. The bank needs an independent auditor to look at questions like these:
- Was consent for each purpose collected against a valid, itemised notice, and can the bank produce the record?
- When customers withdrew consent, did processing actually stop, including at its processors?
- Are rights requests (access, correction, erasure, grievance) being closed within the published timelines?
- Is personal data being erased once the purpose is served, as the retention rules require?
- Are breach intimations going out to the Board and to affected customers as the Rules require?
An auditor can only answer these with evidence. That means time-stamped consent records, notice versions, withdrawal logs and a trail of every rights request, kept in a form that cannot be quietly edited after the fact.
What to do now
The DPDP Rules were notified on 13 November 2025 with an eighteen-month runway. The duties under Sections 9 and 10, along with notice, consent and rights, become enforceable on 13 May 2027. That is about seven months away. These corrections are a good prompt to check four things:
- Split your consent journeys. Make sure age-gating and parental verification for children run separately from guardian verification for persons with disability. Each needs its own evidence.
- Do not assume disability means guardianship. Adults with a disability who have no appointed guardian consent for themselves. Your flows should not push them into a guardian journey by default.
- If you are, or may become, an SDF, scope a real data audit. List the controls an auditor will test, and check that your financial, internal and ISO audits are not being counted as a substitute.
- Get your evidence audit-ready. Consent receipts, notice versions, withdrawals and rights requests should be logged in a way an independent auditor and the Board can verify.
The bigger picture
ConsentEra is built for exactly that kind of proof, from verifiable parental and guardian consent flows to tamper-evident consent records and an audit trail that an independent data auditor can check end to end. If you would like to see how your current setup measures up, book a walkthrough with our team.
Common questions
Does this correction create any new compliance obligation or move the 13 May 2027 deadline?
No. The MeitY order only corrects wording in Section 9(1) and Section 10(2)(c)(ii) of the DPDP Act - it creates no new duty, and the 13 May 2027 commencement date for the substantive obligations is unchanged.
Can an ISO 27001 certificate or a statutory financial audit satisfy the Section 10(2)(c)(ii) audit requirement for a Significant Data Fiduciary?
No. The corrected text, 'periodic data audit', makes clear the audit must be the same kind described in Section 10(2)(b) - an independent review of how the organisation processes personal data, measured against the DPDP Act. A financial or ISO audit can feed into it but cannot replace it.
Does an adult with a disability always need a guardian's consent under Section 9(1)?
No. Section 9(1) applies to a person with disability only where a lawful guardian has been appointed under the relevant guardianship law. An adult with a disability who manages their own affairs and has no appointed guardian consents for themselves, like any other adult.
Sources
Mukul Verma
Founder, ConsentEra
Mukul builds ConsentEra's consent and data-protection platform. He writes about what the DPDP framework actually demands of an engineering team - the parts that turn out to be hard once you try to ship them.