The Digital Data Protection Rules Have Hits and Misses

Some provisions can set a global example for age-gating but others would overburden data fiduciaries

- RAHUL MATTHAN

The draft Digital Personal Data Protection (DPDP) Rules are finally with us, and the long wait has, for the most part, been worth it. There is enough detail in the rules to give businesses the clarity they need, but not so much that compliance becomes cumbersome. That said, there are two areas—data breaches and the obligations of significant data fiduciaries—where I believe the government has exceeded its brief. It has, in the process, greatly increased the burden on data fiduciaries.

Rule 6 provides a definition of the term "reasonable security measures" mentioned in Section 8 of the DPDP Act. As a result, data fiduciaries now have to put in place at least seven distinct types of measures to safeguard against data breaches. While I have no argument with as many measures as are necessary to protect data, why all data fiduciaries must implement these seven measures is beyond me. Section 8 only required data fiduciaries to take reasonable security safeguards. The government should have left well alone and allowed individual data fiduciaries to determine what is reasonable in their own context. By insisting that everyone has to put in place all these measures, it is disproportionately increasing the burden on small data fiduciaries.