Pioneering a new era of data protection

Artificial Intelligence has revolutionized our lives and made many jobs easier. But in this new era, a few professions find their roles more challenging. Among them is the job of sci-fi script writers and technology lawmakers. These roles are becoming increasingly demanding in a landscape of rapid innovation. Drafting regulations aims to bring order, justice, and social welfare. Yet, technology regulators face unique hurdles because they must account for a constantly evolving horizon.

The Government of India recently published the much-anticipated draft Digital Personal Data Protection Rules. These Rules are intended to provide implementation procedures and practical guidance on enforcing the provisions of the Digital Personal Data Protection Act (DPDPA). While some stakeholders might have expected much more exhaustive compliance requirements, the draft Rules are concise and simple. This simplicity, however, does not detract from their significance; the Rules build on the Act’s guiding principles and avoid prescriptive technology bindings—a critical feature for future-ready regulations in a fast-changing technological world.

Consent Manager

One of the pioneering features of the Indian data protection framework is the concept of a formal "Consent Manager." The First Schedule of the Rules details the registration process and obligations of Consent Managers. This structured approach is poised to enhance efficiency, standardization, and user experience in managing consent. By formalizing this process, India sets a global benchmark for improving data protection practices.

Protection of Children’s Personal Data

There has been an alarming rise in cyberbullying and cybercrime involving children. The DPDPA attempts to address this problem by suggesting stronger controls for onboarding children to digital platforms. The Rules provide guidelines for obtaining verifiable parental consent before collecting children’s personal data. Unlike many global regulations, the Indian framework holds service providers accountable for ensuring consent is genuinely from a parent or legal guardian and that the child’s age has been verified. While requiring significant operational changes, this accountability has been articulated through detailed illustrations and tools like digital locker facilities. Additionally, the Rules offer exemptions for healthcare and education contexts where such consent may be impractical or unnecessary.

Risk Reduction

To mitigate risks such as identity theft, the Rules mandate that e-commerce, gaming, and social media platforms must not retain personal data if a user has been inactive for three years. This data minimization strategy is an effective way to reduce exposure to potential data breaches.

Processing by State Entities

The legislation allows the state and its instrumentalities to process personal data, a provision that has drawn criticism. However, the Second Schedule outlines stringent safeguards, requiring lawful processing limited to specific purposes, the accuracy of data, and restricted retention periods. These provisions align with global best practices and aim to balance public interest with individual privacy.

Other Key Provisions

The Rules mandate that personal data breaches must be reported within 72 hours, accompanied by clear communication protocols. Reasonable security safeguards have been thoughtfully included to remain neutral to specific technologies while accommodating future advancements. Simple and practical notification requirements for data collection reflect the Rules’ user-centric approach. Additionally, the Data Protection Board’s functioning as a digital office is a progressive step toward efficiency and streamlined governance.

A Balanced Perspective

The government’s efforts in drafting these Rules are commendable. They are progressive and straightforward, promising to strengthen India’s data protection regime. However, in certain scenarios, the simplicity may also lead to ambiguity. The effectiveness of these Rules will depend significantly on the swift establishment and operation of the Data Protection Board. Implementing concepts like Consent Managers and verifiable parental consent across digital platforms will be pivotal.

Notably, the Rules’ inclusive language, continuing the use of feminine pronouns, reflects the Act’s progressive ethos. The consultation process that shaped the Digital Personal Data Protection Act underscores the importance of stakeholder engagement. With the draft Rules now open for feedback, India takes another step toward becoming a digitally responsible nation. Through an effective consultation process and ensuring timely implementation, these regulations hold the potential to set a global benchmark in data protection.

A version of this article was published by The Economic Times -Inisights.com on January 08 2025. The same can be read here