India's data privacy revolution: DPDP Act draft rules unveiled

In a significant move towards strengthening India's data protection landscape, the Ministry of Electronics and Information Technology (MeitY) unveiled the much-anticipated draft rules for the Digital Personal Data Protection (DPDP) Act on January 3. This development comes 16 months after the Act's initial notification in August 2023, marking a crucial milestone in the country's journey towards comprehensive data privacy legislation.

The draft rules, now open for public consultation until February 18, 2025, aim to operationalise various aspects of the DPDP Act and ensure robust data protection mechanisms across India's digital ecosystem. As businesses prepare to navigate this new regulatory landscape, understanding the key features of these rules becomes paramount.

One of the most notable aspects of the draft rules is the proposed staggered implementation approach. Five rules related to the selection and functioning of the Data Protection Board (DPB) are set to come into force immediately, while other rules will be effective at a later date. This phased approach allows organizations to adapt gradually to the new requirements.

The DPB, envisioned as a digital office with powers to investigate breaches and enforce penalties, will play a pivotal role in adjudicating personal data breaches. With the authority to conduct remote hearings and impose monetary penalties of up to Rs 250 crore, the DPB is poised to become a formidable regulatory body in the data protection sphere.

For businesses dealing with children's data, the draft rules introduce stringent requirements. Verifiable parental consent must be obtained before processing any personal data of a child, and the use of such data is restricted to activities necessary for their well-being and safety. This provision underscores the government's commitment to protecting vulnerable user groups in the digital space.

The draft also outlines specific standards for Consent Managers, entities that will play a crucial role in facilitating data principals' control over their personal information. These managers must be companies incorporated in India with a minimum net worth of Rs 2 crore and maintain independence from Data Fiduciaries to avoid conflicts of interest.

For organizations classified as significant data fiduciaries, the rules propose additional responsibilities, including conducting annual Data Protection Impact Assessments. This requirement aims to ensure that larger entities handling substantial amounts of personal data maintain the highest standards of data protection and privacy.

As the business community digests these draft rules, several areas have been identified as requiring further clarity. These include verifiable consent mechanisms, cross-border data transfers, breach notification processes, and the challenges posed by emerging technologies like Artificial Intelligence. The coming weeks will be crucial for stakeholders to provide input and shape the final regulations.

The release of these draft rules signals a new era for data protection in India. As the country moves towards finalizing its first comprehensive data protection framework, businesses across sectors must prepare to develop robust data privacy and protection implementation programs. The government's approach to balancing individual privacy rights with the need for data processing in the digital age will be closely watched as these rules evolve into their final form.

For B2B enterprises in India, this development presents both challenges and opportunities. While compliance may require significant adjustments to existing data handling practices, it also opens doors for innovative solutions in data management and privacy protection. As the consultation period progresses, businesses are encouraged to actively participate in shaping these regulations, ensuring that the final framework fosters a secure and responsible digital ecosystem while supporting India's growing digital economy.