Digital Personal Data Protection Rules draft to be published within 30 days

The government will release the draft rules for implementing the Digital Personal Data Protection Act (DPDPA) within 30 days. The framework is ready and a draft of the DPDP rules will be published for public consultation within thirty days, IT minister Ashwini Vaishnaw said on Monday.

Vaishnaw confirmed that the framework of DPDP Act is now complete, with the work flow which includes how to file complaints, taking up cases and appeals and other details. He also said that the simplicity of language which the government has adopted for all Bills will be apparent in the draft rules.

Stakeholders will likely have 45 days following the release of the draft rules to submit their feedback.

The Data Protection Board has also been set which is likely to be established during the same period, as per reports.

The DPDPA rules, which have been delayed for several months, will reinforce the existing data privacy law, while amendment to the IT rules will address crucial issues like artificial intelligence-driven misinformation and deepfakes until a comprehensive Digital India Act is formulated.

The DPDP Act provides specializes protections for children and persons with disabilities. It is crucial for businesses to understand these laws to manage their systems in a compliant manner. Failure to comply with the DPDP’s provisions on children’s data can attract penalties up to Rs 200 Crores. DPDP Law says that a child’s personal data cannot be processed without parental consent. The same applies for persons with disabilities and their lawful guardians.

The DPDP Act further prohibits tracking or behavioural monitoring of children or targeted advertising directed at children.

Union Minister Ashwini Vaishnaw had recently said, “Drafting of DPDP Rules is in very advanced stage. We will start the industry consultation now... Whatever extensive consultations will be required; we will do those. We won’t rush through. We will prefer as consultative a process as we can, like you saw in the Telecom Bill and the DPDP Act.”

The DPDP Rules are a top priority, he said. “AI [artificial intelligence] is also a very important item. But first, we have to make sure that DPDP in its digital form comes into shape,” he added.

The Digital Personal Data Protection Act, implemented in 2023, refers to the legislative and regulatory measures implemented to protect people’s privacy and security of their personal data in the digital sphere in India. The Act attempts to create thorough rules and standards for the gathering, processing, storing, and sharing of personal data by organizations and entities operating within India.

The DPDP Bill was first introduced in 2022, and in August 2023, it was revised and passed by both houses of the Indian parliament. As of now, the provisions of the DPDP Act have not been brought into force. The Act is expected to come into force in July 2024 through a government notification.