New Delhi, Nov 14 (NationPress) The government has issued comprehensive guidelines under the Digital Personal Data Protection (DPDP) Act, enforcing rigorous data-retention policies for e-commerce platforms, social media entities, and online gaming firms.

According to these new regulations, platforms are mandated to eliminate the personal data of any user who has not accessed or utilized the service for three consecutive years. This rule is applicable to online gaming companies with over 5 million users, as well as social media and e-commerce platforms boasting more than 20 million registered users in India.

Companies are required to notify the inactive user 48 hours prior to data deletion, alerting them that their data will be erased if they do not engage with the platform within that timeframe.

The Act also sets a higher compliance level for significant data fiduciaries, which are digital platforms with over 5 million users.

To ensure that their systems, algorithms, and procedures do not compromise user rights, these organizations must conduct an annual audit and a Data Protection Impact Assessment. They are also obligated to verify each year that their technical measures remain secure and compliant.

While the DPDP Act allows for cross-border transfers of personal data, the government emphasizes that these transfers must adhere to regularly communicated rules, especially when user data is sent to a foreign nation or any organization under foreign government control.

These new regulations are part of a broader effort to enhance data governance and improve user protection in the rapidly evolving digital environment, marking the operationalization of India's inaugural digital privacy legislation.

The government has officially notified the regulations under the Digital Personal Data Protection (DPDP) Act, triggering the compliance timeline for companies managing user data.

Social media networks, online platforms, and any organizations managing personal data are mandated by this framework to provide users with a thorough explanation of the information collected and clarify how it will be utilized.

“With the DPDP Rules now implemented, Indian businesses have a clear pathway on how they collect, process, secure, and manage personal data. The phased rollout is vital; it provides organizations with the opportunity to operationalize privacy, adjust their data architecture, and integrate accountable fiduciary practices seamlessly,” stated Murali Rao, Partner and Leader, Cybersecurity Consulting, EY India.