MeitY seeks industry views on fast-tracking DPDP Act rollout, proposes 12-month compliance timeline

The Ministry of Electronics and Information Technology (MeitY) has asked social media platforms and digital companies to submit their views on accelerating the implementation of key provisions under India’s Digital Personal Data Protection (DPDP) Act and Rules, including a proposal to shorten the compliance timeline for data fiduciaries from 18 months to 12 months.

In an email sent to platforms following a January 22 meeting, the ministry said it is considering three major changes to the enforcement roadmap and invited industry feedback by February 4, as per a Moneycontrol report.

“The time duration for the obligation on Data Fiduciaries as mentioned in the DPDP Act & Rules [is proposed] to be reduced to 12 months from the given 18 months,” the email stated.

As part of the proposed changes, MeitY is also considering bringing Rules 15 and 23 of the DPDP Rules into effect immediately, while operationalising Rule 8(3) within three months.

Rule 15 sets out conditions under which personal data may be processed for research, archiving and statistical purposes in de-anonymised form, while Rule 23 deals with miscellaneous procedural aspects of the DPDP framework. Rule 8(3), which the government wants to enforce within three months, allows data fiduciaries to retain personal data beyond its original purpose in cases where it is required by law, court orders, or for investigation and legal proceedings, subject to safeguards.

During the January 22 meeting, officials shared a presentation outlining recommendations to compress enforcement timelines across several regulatory provisions. One proposal suggested immediate enforcement of certain rules governing cross-border data transfers and classification of personal data, on the grounds that they do not require significant infrastructural upgrades by companies.

The ministry has also proposed reducing the enforcement window for Rule 13 — which governs obligations of Significant Data Fiduciaries (SDFs) — to 12 months. This includes provisions related to processing specific categories of personal data within India, based on recommendations from a government-appointed committee.

Another proposal under consideration is the immediate operationalisation of Section 17(2) of the DPDP Act, which would require notifying authorised agencies and implementing an exemption framework for certain specified data processing activities.

Major technology companies are expected to be classified as Significant Data Fiduciaries once formal designations begin, based on factors such as the volume and sensitivity of personal data processed, and potential risks to sovereignty, public order and electoral integrity.

Under the DPDP framework, SDFs will face additional compliance requirements, including annual data protection impact assessments, independent audits, and obligations to ensure that algorithmic systems processing personal data do not infringe user rights. The rules also empower the Centre to impose restrictions on cross-border transfers for certain categories of sensitive personal data.

However, the government’s move to compress compliance timelines is likely to face resistance from industry, which has repeatedly argued that DPDP compliance requires extensive technical and operational changes across data infrastructure, consent systems, and grievance redress mechanisms.

Officials said no final decision has been taken and that the ministry is currently gathering stakeholder feedback before proposing any formal amendments to the DPDP Rules.