INDIA UNVEILS DRAFT RULES FOR DATA PROTECTION

GS2 – GOVERNANCE

Recently, Ministry of Electronics and Information Technology (MeitY) released the draft rules for the Digital Personal Data Protection Act (DPDP). Following its passage in Parliament in August 2023, these draft rules aim to clarify several aspects of the law. Stakeholders can provide feedback through the MyGov portal until February 18, 2025.

Key Features of the Draft Rules

1. Obligations of Data Fiduciaries
   • Data fiduciaries must handle personal data lawfully, fairly, and transparently.
   • Specific guidelines address obligations related to data security, processing, and storage.
2. Processing Children’s Data
   • Verifiable consent from a child’s parent or legal guardian is mandatory for processing personal data.
   • Exceptions include activities essential to health or educational purposes, provided they prioritize the child’s well-being.
3. Role of Consent Managers
   • Consent managers must:
     • Be incorporated in India.
     • Have a minimum net worth of Rs 2 crore.
     • Maintain independence to avoid conflicts of interest.
   • They provide certified platforms to allow Data Principals (individuals) to manage their consent effectively.
4. State’s Data Processing
   • Permitted for issuing subsidies, benefits, and services.
   • Subject to strict compliance standards to ensure security and legality.
5. Establishment of the Data Protection Board (DPB)
   • A regulatory body to oversee compliance, investigate breaches, and enforce penalties.
   • Designed for digital-first operations, including remote hearings, to improve accessibility and efficiency.

Terms and Definitions

• DPDP: Digital Personal Data Protection Act.
• MeitY: Ministry of Electronics and Information Technology.
• Data Fiduciary: An entity that processes personal data.
• Consent Manager: An entity managing consent for data processing.
• Data Protection Board: The body overseeing compliance and enforcement of the Act.