The DPDP Act Is Now Being Built in Real Time — By Bureaucrats, Not Judges

October 2026 will likely be remembered as the month India stopped debating whether the DPDP Act would survive, and started asking how it would actually work. Three developments — a Removal of Difficulties Order from MeitY, a Cabinet Secretary directive to every Union Ministry and State Government, and a Supreme Court that refused to stay the Act while sending constitutional questions to a larger bench — collectively signal that the DPDP regime is no longer theoretical. It is being operationalised, piece by piece, even as its constitutional validity remains unresolved.

The Removal of Difficulties Order: Small Text, Large Consequences

On 5 October 2026, MeitY issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, effective the following day. On its face, it addresses two narrow points. First, it clarifies consent requirements for persons with disabilities — a constituency the original Act conspicuously failed to address with any precision. Second, and more consequentially for corporate India, it replaces the word "audit" with "data audit" in the context of Significant Data Fiduciaries (SDFs).

That substitution is not cosmetic. The DPDP Act, 2023, under Section 10, empowers the Central Government to designate certain Data Fiduciaries as SDFs, subjecting them to heightened obligations including periodic audits. The ambiguity around what "audit" meant — financial audit, compliance audit, security audit — had generated genuine uncertainty in boardrooms. By specifying "data audit," MeitY has narrowed the scope but also, arguably, signalled that SDF obligations will be substantive and technical, not merely procedural box-ticking. Lawyers advising technology companies, banks, and large platforms should treat this as a preview of the compliance architecture that will be fully enforceable from May 2027.

The Removal of Difficulties Order is the first time the executive has used its Section 38 power to substantively interpret the DPDP Act. It will not be the last.

The Cabinet Secretary Directive: The State Begins to Comply With Itself

The 20 August 2026 directive from the Cabinet Secretary is, in many ways, the more significant document. It instructs all Union Ministries, State Governments, and Union Territories to prepare time-bound DPDP implementation plans, designate senior officers responsible for compliance, map personal data processing activities, and review privacy notices, third-party arrangements, and grievance mechanisms.

This is remarkable for a simple reason: the Indian State is the country's largest data fiduciary. Aadhaar, DigiLocker, UMANG, Ayushman Bharat, AgriStack — the government processes personal data at a scale no private company approaches. For the Cabinet Secretary to formally direct ministries to comply with DPDP obligations is an acknowledgment that the State cannot exempt itself from the framework it has created. Whether this directive translates into actual compliance, or remains a paper exercise, will determine whether the DPDP Act has any credibility as a rights-based instrument.

Practitioners advising government departments, PSUs, and state-level agencies should note: the directive creates a documented trail. If a ministry fails to comply and a breach occurs, the absence of a DPDP implementation plan will be Exhibit A in any proceeding before the Data Protection Board.

The Supreme Court's Calculated Silence

The Court's decision to issue notice in the challenge to the DPDP Act and Rules, refer the matter to a larger bench, and — critically — refuse to stay the legislation at the interim stage, tells you everything about the judicial mood. The Court is not convinced enough of the Act's infirmity to halt its operation, but it is concerned enough to escalate the constitutional questions.

The most consequential challenge targets Section 44(3) of the DPDP Act, which amended the Right to Information Act, 2005, to expand the personal information exemption. The original RTI Act, under Section 8(1)(j), exempted personal information from disclosure only if it had no relationship to public activity or interest, or if disclosure would cause an unwarranted invasion of privacy — and even then, a public interest override existed. Section 44(3) of the DPDP Act effectively removes the public interest balancing test for personal information, converting a qualified exemption into an absolute one.

This is not a technical amendment. It is a structural shift in the transparency architecture. If Section 44(3) survives, any information that can be characterised as "personal" — and in the digital age, almost everything can — becomes immune from RTI disclosure regardless of public interest. For lawyers handling RTI matters, the practical advice is stark: file applications now, because the window may be closing.

Sectoral Flashpoints: APAAR, AgriStack, and Digi Yatra

The DPDP Act's real-world friction is already visible in sector-specific litigation. A court has held that the APAAR Scheme — the automated permanent academic account registry for students — falls squarely within the DPDP Act's ambit, meaning that collection, processing, storage, retention, and sharing of student data must comply with the Act's consent and purpose limitation requirements. This is significant for ed-tech companies and state education departments alike.

In agriculture, the AgriStack initiative faces what commentators are calling a "consent deficit" — the uncomfortable reality that farmer data is being aggregated at scale without meaningful, informed consent as the DPDP Act requires. And in Kerala, the High Court has demanded to know the status of the Data Protection Board in a PIL concerning Digi Yatra, the facial recognition-based airport entry system, reportedly urging that the Board be made functional within eight weeks.

These are not isolated skirmishes. They are the opening battles in a long war over how India's data protection framework will apply to the State's own digital infrastructure.

What This Means for Practice

The 13 May 2027 deadline for full substantive obligations is now less than seven months away. If you are advising clients — whether private companies or government bodies — the time for "wait and watch" has passed. The Removal of Difficulties Order shows that MeitY is actively interpreting the Act. The Cabinet Secretary directive shows the government is holding itself to account, at least on paper. And the Supreme Court's refusal to stay the Act means compliance planning cannot be deferred on the hope of judicial intervention.

The DPDP Act is not waiting for the courts. Neither should you.