India Data Protection & Privacy Regulation

Lawful Processing & Special Data

Section 9(1) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to obtain verifiable consent of a parent or lawful guardian before processing the personal data of a child, and separately requires verifiable consent of the lawful guardian of a person with a disability, where such a guardian exists. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarified the wording of this provision with effect from 6 October 2026, but the clarification is textual only: it introduces no new consent threshold and does not bring the duty into operative effect ahead of schedule. The provision's substantive commencement remains fixed to 13 May 2027, alongside the rest of the Act's compliance tranche.

Until that date, data fiduciaries processing personal data relating to children or to persons with disabilities who have a lawful guardian are not yet subject to the verifiable-consent duty in binding operative terms, notwithstanding that the underlying Act provision has been enacted and its wording settled. The legal position is therefore one of a duty that exists on the statute book in clarified form but awaits its appointed commencement date before it takes practical effect.

No other development in lawful-processing or special-category data was evidenced this period; the broader consent and processing-ground architecture of the Act is unchanged and continues to await its 13 May 2027 commencement alongside Section 9(1).

Outlook

The operative question for this module is less the content of the consent duty, which is now textually settled, than the practical mechanics data fiduciaries will need to have in place by 13 May 2027: verification methods for parental and guardian consent, and how these interact with the Consent Manager framework due to begin registration from 13-14 November 2026. Further clarity on verification mechanics would be the next material development to watch for.

Lawful Processing & Special Data

Section 9(1) of the Digital Personal Data Protection Act, 2023 requires verifiable consent from a parent or lawful guardian before a Data Fiduciary may process the personal data of a child, or of a person with a disability who has a lawful guardian. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 corrects the wording of this provision so that the two categories, children and persons with disabilities, are textually distinct from one another, a change the Ministry of Electronics and Information Technology describes as editorial rather than substantive.

This textual correction took effect alongside the Order, understood to be 6 October 2026, but the underlying substantive consent duty it corrects is enacted and not yet effective: it forms part of the third-phase Data-Fiduciary obligations scheduled to commence on 13 May 2027. Until that commencement date, the verifiable-consent requirement for processing children's and disabled persons' data is a provision on the books rather than an operative duty, and entities processing such data in India should plan against the 13 May 2027 commencement date as the point at which the requirement, in its now textually corrected form, becomes enforceable.

Outlook

The operative milestone for this provision is the 13 May 2027 commencement of the substantive Data-Fiduciary duties. No further amendment or clarification to the consent mechanics for children and vulnerable persons was identified this cycle beyond the textual correction itself.

Lawful Processing & Special Data

Under the Digital Personal Data Protection Rules, 2025, Data Fiduciaries are required to provide clear, itemised notices to data subjects specifying the purpose or purposes of processing, the categories of personal data being processed, applicable retention periods, and the mechanisms available for withdrawing consent. This notice standard is more granular than a general privacy-policy disclosure, requiring itemisation rather than an omnibus statement of purposes, and it establishes consent withdrawal as a mechanism that must be actively made available rather than merely implied.

These consent and notice requirements form part of the same Rules package that establishes the Data Protection Board and the phased commencement timetable described elsewhere in this brief; as such, the practical enforceability of the notice standard tracks the same phased schedule running through to 13 May 2027.

Outlook

The notice and consent standard is enacted but not yet fully in force under the phased commencement schedule. Organisations should expect scrutiny of notice itemisation practices to increase as the Board's operational capacity develops and as the substantive-obligation deadline of 13 May 2027 approaches.

Controller/Processor Duties

Section 10(2)(c)(ii) of the Digital Personal Data Protection Act, 2023, which touches the data-audit obligations of significant data fiduciaries, had its wording clarified by the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, with effect from 6 October 2026. As with the parallel clarification to Section 9(1), this is a textual correction: it does not create a new duty, does not alter the substance of the data-audit requirement, and does not change when that requirement takes effect. The data-audit duty, along with the balance of controller- and processor-facing obligations such as breach-notification duties under Rule 7 of the Digital Personal Data Protection Rules, 2025, remains part of the staged tranche commencing 13 May 2027.

No independently retrieved pinpoint detail on the exact breach-notification deadline wording in Rule 7 was confirmed against gazetted text this period; secondary compliance commentary shows minor inconsistency on this point, and that gap is noted rather than resolved here.

Taken together, the controller/processor duties picture for this period is one of continuity: the only change is a wording correction to an audit-related provision, with the operative compliance burden, data audits, breach notification, security safeguards and the rest, still awaiting its 13 May 2027 commencement date.

Outlook

Controllers and processors preparing for the 2027 tranche should expect the data-audit and breach-notification provisions to be the areas most likely to see further clarificatory instruments of this kind before substantive commencement. A primary-source confirmation of the precise Rule 7 breach-notification deadline would resolve the one open pinpoint gap in this module.

Controller/Processor Duties

The Digital Personal Data Protection Rules, 2025 impose significantly enhanced duties on Significant Data Fiduciaries, a heightened category of controller subject to obligations beyond those applying to ordinary Data Fiduciaries. Significant Data Fiduciaries must conduct annual Data Protection Impact Assessments and audits, a recurring accountability obligation rather than a one-time compliance exercise. All Data Fiduciaries, not only the Significant category, must notify the Data Protection Board and affected individuals of personal data breaches, with a detailed submission required within 72 hours of the breach becoming known — a materially fast notification window by comparative standards.

Significant Data Fiduciaries also face a targeted cross-border restriction under Rule 13(4), addressed in full under Cross-Border & Adequacy, which prohibits transferring traffic data pertaining to the flow of personal information outside India. Rule 13(5) separately constitutes a committee tasked with recommending further Significant-Data-Fiduciary-specific measures, suggesting the compliance burden on this category of controller is likely to continue to expand.

Outlook

The 72-hour breach-notification clock and the annual DPIA/audit cycle for Significant Data Fiduciaries are the two obligations most likely to generate near-term compliance activity as the Rules phase into force. The Rule 13(5) committee's eventual recommendations are worth monitoring as a likely source of further SDF-specific obligations.

Cross-Border & Adequacy

India has not adopted an EU-style adequacy, standard-contractual-clause, or binding-corporate-rules framework for cross-border personal data transfers. Instead, the Digital Personal Data Protection Rules, 2025 impose a narrower, targeted restriction: Rule 13(4) prohibits Significant Data Fiduciaries specifically from transferring any traffic data outside India where that data pertains to the flow of personal information. This is a data-localisation measure aimed at a defined category of data and a defined category of controller, rather than a general cross-border transfer-control regime applicable to all personal data or all data fiduciaries.

Rule 13(5) establishes a committee to recommend further measures specific to Significant Data Fiduciaries, which may in time expand the scope of cross-border restrictions currently in force. As of this cycle, no broader adequacy-assessment mechanism or transfer-safeguard instrument analogous to the EU General Data Protection Regulation's Chapter V exists in the Indian framework.

Outlook

Watch for the Rule 13(5) committee's recommendations, which represent the most likely near-term source of any expansion to India's currently narrow, traffic-data-specific localisation restriction. Organisations processing traffic data through Significant Data Fiduciary structures should treat the current Rule 13(4) restriction as a hard constraint on data flow architecture.

Children & Vulnerable Groups

The guardian-consent provisions of the Digital Personal Data Protection Act received a textual correction rather than a substantive change. The Removal of Difficulties Order, 2026, made under section 43(1) on 5 October 2026 and gazetted on 6 October, made a parallel correction to the guardian-consent wording in section 9 alongside its correction to the audit-terminology wording in section 10. The correction addresses drafting precision in the text governing consent for children and for persons with disabilities who have a lawful guardian; it does not alter the underlying consent mechanism itself, and that underlying mechanism has not yet become an operative duty.

The timing matters for how this correction should be read. Section 9's guardian-consent duty sits within the substantive block of obligations that is scheduled to commence around 13 or 14 May 2027, alongside the bulk of the Rules numbered 3, 5 through 16, 22 and 23. Until that date, the guardian-consent requirement, like the rest of the substantive controller and processor duties, remains a prospective obligation rather than a binding one. The October correction is therefore best understood as the legislature and executive tidying the statutory text in advance of commencement, reducing the risk of ambiguity in the guardian-consent wording once the duty does become operative, rather than as a signal of any change in India's approach to protections for children and vulnerable groups.

No enforcement or adjudicative activity concerning children's data or guardian consent has occurred, consistent with the Data Protection Board of India's own staffing trajectory: the Board's chairperson and members were appointed on 6 June 2026, and as of mid-October 2026 it was still reported to be building out its operational capacity, meaning no substantive breach of any kind, including in relation to guardian consent, could yet be adjudicated under it.

Outlook

The guardian-consent duty under section 9 will become a live compliance question only once the substantive block of obligations commences, expected around 13 to 14 May 2027. Between now and then, the corrected wording stands as the operative text that will apply from that date, and further drafting refinements of this kind remain possible as the Act's staged implementation continues.

Children & Vulnerable Groups

The Digital Personal Data Protection Act, 2023 extends its verifiable-consent duty under Section 9(1) beyond children to persons with a disability who have a lawful guardian, requiring a data fiduciary to obtain the guardian's verifiable consent before processing that person's personal data, on the same footing as parental consent for a child. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarified the wording of this provision with effect from 6 October 2026. The clarification affects phrasing only; it does not expand, narrow or bring forward the duty, which remains part of the Act's substantive-compliance tranche staged to commence on 13 May 2027.

This means that, as of the current period, neither limb of the Section 9(1) duty, consent for processing a child's data nor consent for processing the data of a person with a disability who has a lawful guardian, is yet in binding operative effect, notwithstanding that both are now textually settled provisions of an enacted Act awaiting their appointed commencement date.

No other development specific to children or vulnerable groups was evidenced this period.

Outlook

The practical significance of this module's one development is interpretive rather than operational for now: data fiduciaries handling data relating to children or to persons with disabilities with lawful guardians have a settled text to plan against ahead of 13 May 2027, without yet facing a live compliance obligation. Verification-mechanism guidance, expected to accompany the broader 2027 commencement, is the next development to watch for.

Children & Vulnerable Groups

The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 makes a targeted correction to how the Digital Personal Data Protection Act, 2023 treats children and persons with disabilities as distinct categories for consent purposes. Prior wording in section 9(1) is corrected so that the verifiable parental-or-guardian-consent requirement reads as applying distinctly to each category rather than conflating them. This correction is characterised by the Ministry of Electronics and Information Technology as textual and editorial, not an expansion or contraction of the underlying protection.

The practical significance of this correction is limited for the present: the substantive duty to obtain verifiable parental or guardian consent before processing a child's or a disabled person's personal data is enacted but not yet effective, forming part of the Data-Fiduciary obligations scheduled to commence on 13 May 2027 under the Rules' third commencement phase. Entities that process data belonging to children or to persons with disabilities in India should therefore treat the corrected wording as the version of the law that will become operative on that date, rather than as a duty currently enforceable.

Outlook

No further children-or-vulnerable-groups-specific development, such as an age-verification standard or a specific guardian-verification mechanism, was identified this cycle. The 13 May 2027 commencement date remains the key forward marker for this module.

Children & Vulnerable Groups

Section 9 of the Digital Personal Data Protection Act, 2023 mandates that organisations obtain verifiable consent from a child's parent or guardian before processing that child's personal data. This is a statutory requirement under the primary Act itself, distinct from the phased Rules-level obligations discussed elsewhere in this brief, though its practical enforceability moves in step with the same phased commencement timetable running through to 13 May 2027.

No further detail on verification mechanisms, age thresholds, or exceptions for parental-consent requirements was available in the claims for this cycle.

Outlook

As the Data Protection Board's operational capacity develops and the substantive-obligation deadline approaches, expect increased organisational focus on verifiable-parental-consent mechanisms for services likely to be accessed by children.

Enforcement & Redress

The Digital Personal Data Protection Act, 2023 vests the Data Protection Board of India with adjudicatory and penalty powers under Sections 27-28 and 33-34, including fines reportedly reaching up to Rs 250 crore for the most serious breaches, though secondary sources show minor variation on the exact penalty figure. Those powers, and the penalty machinery generally, do not commence until 13 May 2027, a date unaffected by any development this period.

Whether the Board currently has appointed leadership able to carry out preparatory work ahead of that commencement date is genuinely disputed on the present record. One source dated June 2026 states that a Chairperson was appointed; two further sources, dated July and August 2026, state that no Chairperson or Member had been appointed as of their publication. Reports suggest the Board's appointment status may remain unresolved, and the conflict between these accounts has not been settled by any primary government confirmation located this period. Given that the Board's adjudicatory powers do not commence until 13 May 2027 in any event, the practical consequence of this dispute is limited for now, it bears on institutional readiness and preparatory capacity rather than on any live enforcement exposure.

Outlook

A primary-source confirmation of the Data Protection Board's current composition would resolve the one open factual dispute in this module. Beyond that, the next material date for enforcement and redress remains 13 May 2027, when the Board's adjudicatory and penalty powers, and the associated fine structure under Sections 27-28 and 33-34, are due to come into force.

Enforcement & Redress

The Data Protection Board of India's capacity to adjudicate remains constrained by an unresolved staffing gap. As at 14 October 2026, the Chairperson post and all four Member posts are understood to remain unfilled, meaning the Board cannot yet hold proceedings or exercise its adjudicatory and penalty powers, notwithstanding that the Board's establishment itself commenced in the first phase of the Digital Personal Data Protection Rules, 2025 on 14 November 2025. This finding rests on a single tracker source referencing posts advertised on 6 May 2026 and referenced again in a Parliament reply of 12 August 2026, so it is reported with appropriate hedging as the current best-available account rather than a confirmed position.

The penalty architecture the Board would eventually apply is itself not fully settled in public reporting. Rule 7 of the Digital Personal Data Protection Rules, 2025 establishes a two-stage breach-notification process, an initial notice to the Board without undue delay, a detailed notice within 72 hours, and notification to affected Data Principals within 72 hours of the Board notification, but sources of comparable standing disagree on the maximum penalty for a failure to meet this breach-reporting duty, with figures of up to Rs200 crore and up to Rs250 crore both reported. Both the breach-notification duty and its associated penalty exposure remain enacted but not yet effective, scheduled to commence as part of the third-phase Data-Fiduciary duties on 13 May 2027.

Outlook

Whether the Data Protection Board of India's leadership posts are filled, and whether the disputed penalty figure for breach-reporting failures is authoritatively resolved, before the 13 May 2027 commencement date will together determine whether the Board is positioned to exercise meaningful adjudicatory and penalty powers from the moment the substantive duties become enforceable.

Enforcement & Redress

The Data Protection Board of India is understood to hold the power to impose penalties of up to two hundred fifty crore rupees for major violations once its full adjudicatory powers become exercisable, a figure drawn from compliance-timeline commentary that has not independently re-verified the precise Schedule pinpoint underlying it this cycle. This penalty ceiling represents a significant potential enforcement exposure once operative, but its practical relevance is presently constrained by two factors: the staged commencement of the underlying substantive obligations, the bulk of which do not take effect until 13 May 2027, and the disputed operational status of the Board itself, which this cycle's sourcing could not resolve either toward confirmed staffing or confirmed non-staffing.

Consistent with this pre-commencement posture, no DPDP enforcement action, fine, or published Board order had been reported as of a 23 July 2026 tracker. This absence of enforcement activity is probable rather than confirmed, and should be read as consistent with, rather than independently diagnostic of, a Board not yet functioning as an adjudicator: the DPDP Act's substantive provisions generally have not yet commenced, so an absence of enforcement activity to date would be expected regardless of the Board's precise staffing status, since there is limited substantive basis for enforcement action under provisions that have not yet taken legal effect.

The redress architecture more broadly therefore remains in a pre-operational phase: the penalty ceiling is specified in the instrument, but neither the staffing question that determines the Board's present capacity to act, nor the substantive commencement dates that determine what conduct is presently sanctionable, currently point toward near-term enforcement activity. This is a structural observation about the sequencing of India's data-protection enforcement architecture rather than an assessment of regulatory leniency or stringency.

Outlook

Enforcement activity under the DPDP Act is unlikely to materialise in volume before the 13 May 2027 commencement of the bulk of substantive obligations, since there is limited sanctionable conduct before that date regardless of the Board's staffing status. The more immediate indicator to watch is whether any enforcement-relevant activity emerges around the Rule 4 Consent Manager registration commencement in November 2026, which would test the Board's operational capacity ahead of the main 2027 commencement date. Resolution of the current Board-staffing dispute remains a prerequisite for assessing whether the penalty architecture, once the underlying obligations commence, will have a functioning adjudicator behind it from day one.

Enforcement & Redress

The Data Protection Board of India, established via the 13 November 2025 notification, holds the power to impose penalties of up to INR 250 crore per violation for security-safeguard failures under the Digital Personal Data Protection Act's penalty schedule — the ceiling for the most severe violation class under the Act. That penalty power is, however, currently the subject of a genuine and unresolved conflict in available reporting. One tracker states that the Board had zero members as of July 2026 and could not yet hear complaints or impose fines, while other commentary describes the Board as already operational. Both positions are drawn from sourced reporting and neither is resolved by the material available this cycle; the state of the Board's actual operational capacity should be treated as disputed rather than settled in either direction.

This uncertainty matters because it determines whether the substantial penalty powers created by the Act are currently exercisable in practice, as distinct from existing on paper pending the Board's full staffing. The full substantive-obligation and penalty regime is understood to become enforceable by 13 May 2027, which may resolve, or may simply coincide with, the current staffing ambiguity.

Outlook

Resolution of the Data Protection Board's actual staffing and operational status is the single most consequential open question in India's data-protection enforcement landscape. Until that is clarified, the practical bite of the INR 250 crore maximum penalty and the Board's broader adjudicatory powers should be treated as uncertain rather than confirmed.