By Vikrant Rana, Anuradha Gandhi and Rachita Thakur
Introduction
India’s first Digital Data Protection Act, 2023 (hereinafter referred to as the “DPDP Act”) was notified with the consent of the President of India in August 2023. The DPDP Act aims to safeguard personal data of individuals and puts guardrails on organisations to prevent data breaches.
The law is yet to come in to force as multiple provisions in the Act require additional clauses and rules. However, the minister for electronics and information technology, Ms. Ashwini Vaishnav has informed that the draft rules under the DPDP Act for consultation will be released within a month. It is reported that the final draft of rules has been reviewed and will be issued for public consultation in September, 2024.
The impending Data Protection Rules
In February 2024, the Parliamentary Standing Committee had criticized the IT ministry for the delay in drafting of rules under the DPDP Act and not specifying a timeline for rolling out the Digital India Bill. In a report tabled in the Lok Sabha on February 08, 2024, the Committee asked the Ministry of Electronics and Information Technology (MeitY) to prioritise the drafting of DPDP rules and to ensure the process is completed with a period of six months.
How are the businesses impacted because of delay?
The delay in rules has resulted in uncertainty for businesses as they are posed with half-led compliances. As mentioned above, there are many provisions under the DPDP Act that require additional clauses and description therefore, with the rules, the companies cannot completely comply with the law. In fact, the some of the companies are following the GDPR however, that does not mean compliance with the Indian law.
Data Fiduciaries are under dilemma with only preliminary deliberations on the DPDP Act. The Rules are critical for all the entities, especially for the Data Fiduciaries as they are obligated to implement the DPDP Act and their preparation is hindered by the absence of Rules.
There is further ambiguity regarding the take of Government over inclusion of rules pertaining to Artificial Intelligence (AI). Presently, the industry is zealously expecting the Rules to be notified anytime with hope to embark on compliance journey with limited friction.