Weaving the safety net: Finer threads in India's data shield

India’s DPDP rules aim to fortify data governance with consent control, breach reporting, and localisation, but clarity and accessibility gaps remain.

- BY GAURAV SAHAY

India’s Ministry of Electronics and Information Technology recently released the much-anticipated draft rules for the Digital Personal Data Protection (DPDP) Act, 2023. Passed by Parliament in August last year, the Act is a landmark step toward safeguarding personal data in India. The draft rules unveiled in January are open for public consultation until 18 February 2025.

The DPDP Act, designed to provide robust safeguards against misuse of personal data, has been eagerly awaited by the industry for clarity on compliance and operational responsibilities. The draft DPDP rules outline key provisions, including mechanisms for data protection, user rights, and establishing a regulatory framework.

THE STRENGTHS

The framework's emphasis on an interoperable platform and robust record-keeping for consents aligns seamlessly with global best practices. This ensures users retain control over their data while holding Data Fiduciaries and Consent Managers accountable. The mandated seven-year retention of consent records establishes a strong foundation for audit trails, fostering trust and ensuring compliance. By incorporating requirements for encryption, obfuscation, and access controls, the framework takes a proactive stance against prevailing cybersecurity threats.

The mandatory retention of logs related to unauthorised access for one year is a practical measure that supports investigations and helps prevent future incidents. Additionally, the specified timelines for notifying Data Principals and authorities demonstrate a commitment to responsiveness and transparency in breach management. Requiring breach reports to include mitigation measures promotes proactive risk management and instils user confidence.