Breach alert, parental nod in digital privacy rulebook

The ministry of electronics and information technology on Friday evening released the draft Digital Personal Data Protection Rules for public consultation, setting the stage for operationalising India's personal data protection regime more than 16 months after the act was notified in August 2023.

- Aditi Agrawal

These rules are the key to operationalising India's Digital Personal Data Protection Act (DPDPA), which has been in the making since an expert group formed under the chairmanship of former Chief Justice of the Delhi high court AP Shah in 2011, recommended India come out with a privacy law.

In 2017, a nine-judge bench of the Supreme Court unanimously recognised the fundamental right to privacy as guaranteed under the Constitution.

Some of the key obligations the rules propose from a user's perspective are requirements for a service provider to clearly and in detail specify what data is being ingested and an immediate alert in the event that their data is breached (for instance, in the case of a hack or a leak). The rules also lay down that verifiable parental consent will be required for those under 18 signing up for a service that needs personal data.

Given the widespread impact—almost all business and activity with any digital interface is covered by this framework—the draft rules propose a staggered implementation, with provisions related to the Data Protection Board (DPB) coming into immediate effect while other aspects like notice requirements and consent management will be implemented later.

The public can submit comments on the draft rules through the MyGov portal until February 18.

DPB, which will be vested with civil court powers, will be responsible for adjudicating personal data breaches and can impose penalties up to 250 crore.

For data breaches, fiduciaries must inform both DPB and affected users "without delay," with detailed reports required within 72 hours. The rules also mandate specific data retention periods and require companies to notify users 48 hours before data deletion.