New Delhi, Jan 4 Industry watchers on Saturday began to review the draft rules for the Digital Personal Data Protection (DPDP) Act, saying it is encouraging to finally witness progress on this front and continued input and guidance from the government will be essential to drive its effective implementation.
The Act was passed in Parliament in August 2023 and the government is seeking feedback on the draft rules through the MyGov portal till February 18, 2025.
“As the industry reviews the draft rules for the Digital Personal Data Protection Act, there are a few initial reflections to consider. These rules were highly anticipated, with the expectation that they would address implementation challenges, procedural gaps, and areas where the Act required further clarity,” said Shreya Suri, Partner, IndusLaw.
The DPDP Act makes it mandatory for data fiduciaries to ensure verifiable consent of a parent before processing any personal data of a child.
As per the draft rules, a data fiduciary will adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable.
The move is aimed at ensuring the privacy of a child on various social media platforms and other websites.
According to Suri, it seems the approach might rely on self-declaration by users, allowing them to indicate whether they are minors or adults.
“This could potentially lead to broader processing of parental or guardian data, which raises interesting considerations regarding the scale and scope of such data collection,” argued Suri.
Another anticipated aspect is the introduction of thresholds for data breach reporting, where minor breaches could have had fewer compliance obligations.
“However, the current draft treats all breaches uniformly, requiring the same level of reporting and notification to the Data Protection Board and affected data principals, without granting any discretion whatsoever to data fiduciaries,” Suri emphasised.
It is likely that stakeholders will adopt practices aligned with the nature and scale of their data processing, but further guidance from the government would be crucial to ensure consistency and compliance across the industry, according to experts.
The draft rules also provide clarity regarding the setting up of the Data Protection Board, appointment and service conditions of the Chairperson and other members of the board.
The IT Ministry has said that the submissions made during the consultation will not be disclosed, and that only a summary of the feedback received will be published after the finalisation of the rules.
According to Mayuran Palanisamy, Partner, Deloitte India, the DPDP draft rules are quite detailed and give much needed direction to the businesses in India by expounding upon compliance to be carried out by them, such as obligations measures for significant data fiduciaries, registration and obligations of consent managers, the establishment and functioning of the Data Protection Board, including specifics of data breach intimation to Data Principles and the Board, process for the Principals to exercise their rights and timelines for Data Fiduciaries to respond to grievances.
“We foresee that businesses will face some complex challenges in managing consent as it forms the heart of the law. Maintaining consent artefacts and offering the option to withdraw consent for specific purposes could necessitate changes at the design and architecture level of applications and platforms,” said Palanisamy.
While the draft does attempt to cover some of these aspects, there is still significant ground to cover.
“I anticipate rigorous public consultations to gather comprehensive feedback, ensuring that the final version reflects the needs and perspectives of all stakeholders. Continued input and guidance from the government will be essential to drive effective implementation,” Suri noted.
Disclaimer: This post has been auto-published from an agency feed without any modifications to the text and has not been reviewed by an editor