Did the October 2026 order create a new school consent deadline?
No new school-specific deadline appears in the order. The government’s Digital Personal Data Protection (Removal of Difficulties) Order, dated 5 October 2026, makes two wording changes to India’s DPDP Act. One concerns the wording of the provision on children and persons with disabilities who have lawful guardians. The other clarifies the wording on data audits for organisations formally designated as Significant Data Fiduciaries. The order itself does not appoint a new commencement date for those sections.
For school leaders, the useful response is to review existing data and permission practices carefully, not to treat an editorial correction as a new requirement to collect a blanket form immediately.
What changed in the parental-consent wording?
Section 9(1) describes verifiable parental consent for processing a child’s personal data, as well as consent from a lawful guardian in the specified case of a person with a disability. The October order inserts the word “of” into the English provision to make the two categories clearer. Its own explanation calls the difficulties textual and editorial. It does not say schools must collect a fresh consent form because of this wording change.
The original commencement notification places section 9 in the group scheduled for 18 months after publication of the November 2025 Gazette. Provisions, exceptions and subsequent notifications should be checked for the relevant activity before treating any date or rule as settled. Other existing laws and responsibilities may apply independently. Ask a qualified adviser how the rules apply to your school’s circumstances.
Does this mean every school must appoint an auditor?
No. The order’s second wording change concerns section 10’s periodic data audit language for Significant Data Fiduciaries. That is a specific legal designation; it is not a label automatically applied to every school. A school may still find a practical internal review useful, but it should not describe it as the same statutory obligation without checking its status and the law.
Four things school teams can do now
- Map the data. List the information the school collects, where it is stored and the organisations that receive it. Include admission forms, learning apps, transport, medical information and event photographs.
- Separate purposes. Explain school administration, learning, safety and publicity uses clearly. Do not assume a permission for one activity covers every other use.
- Check media routes. Trace photographs from collection to approval, parent sharing, public social media and vendor storage. Assign someone to handle a parent’s request and identify the copies and recipients involved.
- Review your notice and partners. Check how families can contact the school and review vendor contracts and access. Record what remains uncertain for discussion with a qualified adviser.
These are preparation steps, not a claim that each one is a separate requirement of the October order. The legal basis, exceptions and effective date can differ by activity.
Where does MediaGuard fit?
MediaGuard by LIT focuses on managing school media workflows. It can support a school’s wider privacy programme, while broader compliance questions may involve the school’s advisers and partners. Discuss the school’s existing systems and integration needs before deciding on a setup.
For practical next steps, see our annual day photo checklist and vendor privacy questions. For wider context, read DPDP Rules 2025 for schools.
Sources checked 30 October 2026: MeitY’s October 2026 order; 2025 Act commencement notification; DPDP Rules, 2025. This is general information, not legal advice.
What does this mean for your school?
Turn the guidance into a practical plan for your school, from policies and staff to parent permissions and media.
