DPDP Act notified; to be rolled out in three phases

In the first phase, some basic parts of the law will come into effect

- RAKESH KUMAR @New Delhi

THE government on Friday notified the much-awaited Digital Personal Data Protection Act (DPDP Act), which will come into force in three phases.

On the day the notification is published, some basic parts of the law will come into effect —these include definitions, rules for setting up the Data Protection Board, and certain powers and procedures. One year after publication, two specific provisions will begin, relating to withdrawing consent and a special obligation for large or “significant” data-handling organisations. The main sections of the Act will start after 18 months. These include rules on how companies can collect and use personal data, how consent must be taken, rights of individuals, rules for children’s data, cross-border data transfers, data-breach duties, and most obligations for significant data fiduciaries.