Data protection law notified, firms get 18 mths to comply

The government has notified the Digital Personal Data Protection (DPDP) Rules, and large parts of the DPDP Act, establishing the operational framework for India’s first comprehensive data privacy law more than two years after Parliament passed the legislation and eight years after the Supreme Court recognised privacy as a fundamental right.

- Sejal Sharma

The rules, published in the official gazette on November 13, lay down detailed timelines and obligations for companies handling personal data and create enforceable rights for users, a crucial part of legal framework to operationalise the Supreme Court's recognition of privacy as a fundamental right in the 2017 Puttaswamy judgment.

Companies have 18 months to comply with the main provisions — they have until May 2027 to comply with all data-handling, retention, consent, child-protection, audit and breach-related requirements, a timeline experts say is a reasonable compliance window.

The rules give a one-year window before the provisions on consent manager registration and related obligations take effect, while the basic framework, including establishment and functioning of the Data Protection Board (DPB), will take effect immediately.

In two separate notifications, the government also formally established the DPB with its head office in the National Capital Region, and that it will comprise four members. Rule 17(1) and (2) lay out the composition for the Search-cum-Selection Committee which will decide who the members will be. On being asked what is the minimum eligibility, qualification of the members of the DPB, IT Secretary S Krishnan said that will depend on the “special knowledge” they possess.

The new rules formally lay down that companies must notify affected users immediately after any personal data breach and inform the DPB within 72 hours with detailed reports on the breach's nature, extent and impact. The 72-hour deadline mirrors the European Union's General Data Protection Regulation standard, though India's framework differs significantly in some aspects with the government retaining prerogative to prevent breach notifications if it decides to.