DPDP Act rules nearing release: 45-day consultation period anticipated

Image by Tung Nguyen from Pixabay

Following inter-ministerial consultations that concluded on December 31, 2024, the draft rules for the Digital Personal Data Protection (DPDP) Act are now being translated and are expected to be released within the next week. This announcement follows approval from the Ministry of Home Affairs.
Once released, the draft rules will be open for public consultation for 45 days. This development aligns with IT Minister Ashwini Vaishnaw's August 2024 statement that the draft rules would be published within 30 days of their framework being finalized.
The DPDP Act, passed by Parliament in August 2023, aims to establish a comprehensive framework for data protection and privacy in India. However, its implementation has been delayed due to the ongoing finalization of the rules.

Highlights:
• Short Transition Period: The draft rules are expected to include a short compliance period of 6-8 months, with significant penalties (up to Rs 250 crore) for data breaches.
• Exceptions for Startups: Early-stage startups may be granted a grace period of 3-6 months to adapt, with exemptions from certain stringent provisions.
• Government Access to Data: The government may demand data for national security purposes.
• Cross-border Data Transfers: Cross-border data sharing with other governments will require notification to the Central Government.
• Stricter Conditions for Data Fiduciaries: The draft rules are expected to impose stricter conditions on entities handling personal data.
• Concerns over Short Transition Period: While the GDPR and Singapore's PDPA provided companies with around two years for transition, the proposed 6-8 month period in India has raised concerns.
• Public Consultation: A 45-day public consultation period will follow the release of the draft rules, allowing stakeholders to provide feedback.
• Addressing AI-Driven Misinformation: The amendment to IT rules will address critical issues like AI-driven misinformation and deepfakes until a comprehensive Digital India Act is formulated.

Also Read: DPDP Act is crucial to protect consumers’ digital privacy and data rights: Irvinder Ray