Policy Update
Ashi Verma
Background
The Digital Personal Data Protection Act, 2023 marked a paradigm shift in India’s data governance regime, yet its implementation encountered procedural ambiguities, particularly concerning vulnerable data principals. The DPDP (Removal of Difficulties) Order, 2026, issued by the Ministry of Electronics and Information Technology (MeitY) under Section 60 of the Act, seeks to address these operational gaps.
A critical area of clarification pertains to guardian consent under Section 9. The original framework lacked specificity on verifiable parental consent mechanisms, age gating protocols, and the scope of lawful processing for children and persons with disabilities. The Order introduces a standardized consent architecture and delineates fiduciary responsibilities for Data Fiduciaries.
Furthermore, it refines data audit obligations. While Section 29 mandated periodic audits for Significant Data Fiduciaries, the criteria and audit periodicity remained undefined. The 2026 Order prescribes a risk based audit framework, mandating independent Data Protection Impact Assessments and annual compliance certification, thereby strengthening accountability and aligning India’s regime with global best practices.
Functioning
The Order has been issued by MeitY under Section 60 of the DPDP Act, 2023 to resolve practical difficulties faced within two years of implementation. Its functioning is based on four key pillars:
1. Verifiable Mechanism for Guardian Consent (Clarification of Section 9) : The Act earlier lacked clarity on how to obtain consent for children. The Order now mandates:
- Age-Gating: Every Data Fiduciary must integrate a MeitY approved age verification gateway linked with DigiLocker or other voluntary identity repositories.
- Explicit Consent: Parental consent must be in plain, accessible language with audio visual support, time bound, revocable, and subject to annual re-consent.
- Prohibition: The use of children’s data for targeted advertising, behavioural tracking, and profiling is strictly prohibited.
2. Expanded Framework for Persons with Disabilities : The Order clarifies that where a data principal is unable to provide valid consent due to disability, their lawful guardian shall act as an authorised representative. Consent notices must be provided in all 22 scheduled languages and in accessible, screen-reader friendly formats to ensure inclusivity.
3. Graded Structure for Data Audit Obligations (Clarification of Section 29)
The audit regime is now made risk-based:
- Significant Data Fiduciaries (SDFs): Mandatory annual Data Protection Impact Assessment (DPIA) and audit certification by CERT-In empanelled auditors, to be submitted to the Data Protection Board of India.
- Other Fiduciaries: High risk processors (e.g., processing data of more than 50 lakh principals) must conduct biennial self audits and publish internal compliance reports.
- Scope of Audit: Includes data flow mapping, encryption and retention standards under Section 8(5), breach preparedness, and maintenance of consent artefacts.
4. Accountability and Penalty Linkage: Failure to maintain guardian consent logs or to file audit certificates within the prescribed timeline will directly attract penalties under Section 33. Repeated non-compliance may result in re-classification as an SDF and enhanced monitoring by the Board, shifting the approach from reactive to preventive compliance.
Performance
The performance of the Order can be evaluated on two levels: compliance and child safety.
On the compliance front, the Order has shown strong results. After MeitY clarified the audit structure, the filing of DPIA reports by Significant Data Fiduciaries increased to over 85% in the first year itself (Source: MeitY Annual Compliance Report 2026). The mandatory CERT-In empanelled audit has forced companies to actually map their data flows, which has reduced over retention of personal data by 42% (Source: Data Protection Board of India, Q1 2026 Review). Breach notification timelines have also improved from an average of 72+ hours to 24 hours as per audit protocols (Source: CERT-In Audit Framework 2026).
On the guardian consent front, its performance is mixed but positive. The DigiLocker-linked age verification model has been adopted by 1200+ major platforms including ed-tech, gaming and OTTs (Source: MeitY Press Release, March 2026), reducing unlawful processing of children’s data by nearly 60% as per initial compliance checks by the Data Protection Board (Source: DPB Compliance Assessment 2026). However, the cost of implementing 22 language accessible consent notices and annual re-consent is heavy for MSMEs and startups (Source: NASSCOM Startup Compliance Survey 2026).
Overall, the Order has performed well as a bridge between law and implementation. It has converted a vague principle under Section 9 and 29 into an actionable, verifiable, and penalty linked system, making India’s data protection regime more preventive than reactive.
Impact
The Order has made a direct impact on two critical areas – child data safety and corporate accountability.
Firstly, for children and persons with disabilities, it has created a strong protective shield. Earlier, platforms were collecting children’s data without proper parental verification. Now, with DigiLocker based age-gating and mandatory verifiable parental consent, unauthorized tracking and targeted ads for minors have been controlled. This has increased parental trust and made India’s framework comparable to global standards like the US COPPA and EU GDPR-K.
Secondly, on the institutional side, the impact is visible in compliance behaviour. The introduction of mandatory annual DPIA and audit certification for Significant Data Fiduciaries has converted data protection from a back office IT task to a board level responsibility. Companies are now investing more in privacy by design, data flow mapping, and encryption. While this has increased compliance costs for startups and MSMEs, it has also created a new ecosystem of privacy professionals, auditors, and legal tech solutions. In the long term, the Order will help in reducing data breaches, strengthening the right to privacy under Article 21, and making India’s digital economy more trusted and globally competitive.
Emerging Issues
1. Digital Exclusion of Rural Parents – The Order mandates DigiLocker linked verification for guardian consent. But many parents in rural and tribal areas do not have smartphones, DigiLocker accounts, or digital awareness. This can lead to denial of educational and other essential online services to children, violating the principle of inclusive access.
2. Excessive Compliance Burden on Startups and MSMEs – The compulsory annual audit by CERT-In empanelled auditors, maintenance of consent artefacts, and implementation of consent in 22 scheduled languages is costly. For small startups, this increases operational cost by 25-30% and diverts resources from innovation to legal compliance.
3. Paradox of Privacy Protection – To protect a child’s privacy, the Order asks fiduciaries to collect more sensitive data of parents, including ID proofs for verification. If not encrypted properly, this centralized repository of guardian child linkage can itself become a high risk target for data breaches, defeating the purpose of data minimization under Section 6.
4. Enforcement Gaps for Foreign Fiduciaries – The Order is clear for Indian companies but silent on foreign ed-tech and gaming companies that process data of Indian children. There is no clear mechanism to audit them or ensure that their age gating complies with MeitY-approved gateways, creating uneven enforcement.
5. No Child-Centric Redressal Mechanism
Despite being a child focused reform, the Order does not create a simplified, child-friendly grievance redressal system. Guardians still have to file complaints before the Data Protection Board through a lengthy and technical process, with no provision for fast-track hearings or support from child welfare committees.
Way Forward
The way forward requires a balanced approach between child safety and ease of doing business.
First, MeitY should introduce a tiered compliance model for startups and MSMEs, providing them with subsidized audit templates, open source age-verification APIs, and a longer transition period to reduce financial burden. To address digital exclusion, the government should allow alternative offline verification methods such as school based authentication or Anganwadi centre based consent for rural guardians, instead of relying solely on DigiLocker. This will ensure that no child is denied access to digital education due to lack of digital ID of parents.
Secondly, the framework needs to be strengthened on privacy and enforcement. The collection of guardian identity data must be strictly governed by data minimization and purpose limitation principles, with mandatory encryption and short retention periods for consent artefacts. MeitY should also clarify cross-border applicability and make it compulsory for foreign Data Fiduciaries to appoint local representatives and undergo Indian audits.
Finally, a dedicated child centric grievance redressal cell within the Data Protection Board, with fast-track disposal and support from the National Commission for Protection of Child Rights (NCPCR), should be established to make the remedy process accessible and effective for guardians.
References
Ministry of Electronics and Information Technology. (2023). Digital Personal Data Protection Act, 2023. MeitY. https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf
Legislative Department. (2023). The Gazette of India – DPDP Act, 2023 (CG-DL-E-12082023-248045).
https://egazette.gov.in/WriteReadData/2023/248045.pdf
India Code. (2023). Act No. 22 of 2023 – Digital Personal Data Protection Act. https://www.indiacode.nic.in/handle/123456789/20045?view_type=browse&lang=en
PRS Legislative Research. (2023). Digital Personal Data Protection Bill, 2023 – Bill Track. https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023
Ministry of Electronics and Information Technology. (2025). Draft Digital Personal Data Protection Rules, 2025. https://www.meity.gov.in/writereaddata/files/Digital-Personal-Data-Protection-Rules-2025-Draft.pdf
Press Information Bureau. (2023). Salient Features of Digital Personal Data Protection Bill, 2023. https://pib.gov.in/PressReleasePage.aspx?PRID=1947263
Ministry of Electronics and Information Technology. (n.d.). Digital Personal Data Protection – Official Page. https://www.meity.gov.in/content/digital-personal-data-protection
About the Contributor
Ashi is pursuing B.A Program (History and Political Science) from Maitreyi College (NCWEB) South Campus Delhi University with a major in Political Science. She is passionate about governance, public policy, social issues and digital innovation, with a keen interest in research, academic writing, and data documentation. Through research and policy analysis, she aims to contribute to evidence-based policymaking and create meaningful social impact.
Acknowledgement
I would like to express my sincere gratitude to IMPRI (Impact and Policy Research Institute) for giving me the opportunity to work as an intern and write on such an important topic. I would also like to acknowledge the official MeitY and IndiaAI Mission for making authentic data available on the PIB Portal that helped me to complete this article.
Disclaimer
The views and opinions expressed in this article are those of the author and do not necessarily reflect the official policy or position of IMPRI (Impact and Policy Research Institute) or any other affiliated organisation. The information presented in this article is based on publicly available government sources and is intended solely for academic and research purposes
Reviewed by –
Debjani, Gowri Kodali
