India DPDPA: Kerala HC Orders Data Protection Board Functional Within 8 Weeks; MeitY Issues Textual Corrections (October 2026)
Two October developments land one month before Consent Manager registration opens on 13 November 2026 (rule 4 of the DPDP Rules — tracked in india-consent-manager-registration-watch):
1. Kerala High Court orders the Data Protection Board to become functional. The Board created by the DPDP Act 2023 "has not yet started working", and the Kerala High Court "has now told the Centre to make it functional within eight weeks" — i.e., roughly early December 2026 — in a PIL about how airports collect and store passengers' personal data (the Digi Yatra case; the Court previously held Digi Yatra cannot force travellers to provide Aadhaar, accepting a driving licence as ID). This is the regulator that must register Consent Managers from 13 November and adjudicate breaches with penalty powers up to Rs 250 crore; its continued non-existence has been the biggest execution risk in the DPDP rollout.
2. MeitY's DPDP (Removal of Difficulties) Order, 2026 — issued 5 October, published in the Official Gazette 7 October — makes two textual corrections under s.43(1) (the three-year window for such orders; the order was also laid before Parliament as s.43(3) requires):
- Section 9(1) — verifiable parental/guardian consent: inserts "of" so the provision reads "the personal data of a child or of a person with a disability", closing the argument over whether "who has a lawful guardian" qualifies both categories. Stakes: the Schedule permits penalties up to Rs 200 crore for breach of the children's-data obligations.
- Section 10(2)(c)(ii) — Significant Data Fiduciary audits: "The Order replaces 'audit' with 'data audit' in section 10(2)(c)(ii)", tying the periodic audit to data-protection compliance; the independent data auditor and the periodic audit remain separate obligations. Stakes: up to Rs 150 crore for SDF obligation violations.
As the CyberPeace analysis puts it: "Data Fiduciaries, auditors and the Data Protection Board will all be working from the same words, so that the distinction between 'audit' and 'data audit', or between a phrase including or omitting 'of', is the sort of gap that can decide an argument."
The 13 May 2027 deadline for most operational duties (notice, consent, breach reporting, and the rule 15 cross-border provisions — see India DPDP Act: Final Rules Notified and 18-Month Phased Compliance Roadmap) is unchanged. Practical to-dos from the commentary: align consent-flow language for children and persons with disabilities to the amended s.9(1); use "data audit" consistently in SDF audit charters and auditor engagement letters; update statutory references in templates and training decks; keep the Gazette text (not summaries) in the compliance file.
What to watch: whether the Centre complies with the 8-week timeline before the 13 November Consent Manager window opens, and which Consent Managers register first once the Board stands up.