Experts Highlight the Importance of Government Guidance for Effective Implementation of DPDP Rules

New Delhi, Jan 4 (NationPress) Industry experts on Saturday commenced their evaluation of the draft regulations concerning the Digital Personal Data Protection (DPDP) Act, noting that it is promising to finally see developments in this area. They emphasized that sustained input and guidance from the government will be crucial for driving its effective implementation.

The Act received parliamentary approval in August 2023, and the government is currently seeking feedback on the draft regulations via the MyGov portal until February 18, 2025.

“As the industry assesses the draft regulations for the Digital Personal Data Protection Act, there are several initial considerations to keep in mind. These regulations were highly awaited, with the hope that they would tackle implementation difficulties, procedural voids, and clarify aspects where the Act needed further elucidation,” remarked Shreya Suri, Partner at IndusLaw.

The DPDP Act mandates that data fiduciaries must obtain verifiable consent from a parent before processing any personal data of a child.

According to the draft regulations, a data fiduciary is required to implement suitable technical and organizational measures to secure that verifiable consent from the parent is obtained prior to processing any child’s personal data, ensuring due diligence to confirm that the individual claiming to be the parent is an identifiable adult.

This initiative aims to protect children's privacy across various social media platforms and websites.

Suri noted that the strategy may depend on self-declaration by users, allowing them to indicate whether they are minors or adults.

“This could lead to a larger processing of parental or guardian data, raising intriguing questions regarding the extent and nature of such data collection,” Suri argued.

Another expected aspect is the establishment of thresholds for data breach reporting, where minor breaches might impose fewer compliance obligations.

“However, the current draft addresses all breaches uniformly, demanding the same level of reporting and notification to the Data Protection Board and the affected data principals, without providing any discretion to data fiduciaries,” Suri highlighted.

Stakeholders are likely to adopt practices compatible with the nature and scale of their data processing, but further government guidance will be vital for ensuring uniformity and compliance across the sector, according to experts.

The draft regulations also clarify the establishment of the Data Protection Board, along with the appointment and service conditions for the Chairperson and other board members.

The IT Ministry has indicated that the submissions made during the consultation will remain undisclosed, with only a summary of the feedback made public after finalizing the regulations.

According to Mayuran Palanisamy, Partner at Deloitte India, the DPDP draft regulations are comprehensive and provide essential direction for businesses in India by detailing compliance requirements, such as obligations for significant data fiduciaries, registration and duties of consent managers, the formation and operations of the Data Protection Board, including specifics about data breach notifications to Data Principles and the Board, processes for Principals to exercise their rights, and timelines for Data Fiduciaries to address grievances.

“We anticipate businesses will encounter intricate challenges in managing consent, which is central to the law. Maintaining consent artifacts and providing options to withdraw consent for specific purposes may require fundamental changes in the design and architecture of applications and platforms,” Palanisamy stated.

While the draft does strive to address some of these elements, there remains considerable progress to be made.

“I expect extensive public consultations to collect thorough feedback, ensuring that the final version accommodates the needs and perspectives of all stakeholders. Continued input and guidance from the government will be vital for achieving effective implementation,” Suri remarked.