The Indian government has released the long-awaited Draft Digital Personal Data Protection (DPDP) Rules, 2023, over a year after Parliament passed the Digital Personal Data Protection Act, 2023. However, the draft rules notably exclude any specific penalties for violations, sparking questions about enforcement and accountability.
Key Provisions of the Draft Rules
The proposed rules lay out detailed guidelines for obtaining and managing personal data. Key highlights include:
- Explicit Consent Mechanisms:
- Individuals must provide explicit consent for data processing.
- Mandatory parental consent is required for processing children's personal information.
- Data Retention and Deletion Policies:
- Entities, termed "data fiduciaries," are required to retain personal data only with consent and delete it after the consent expires.
- These rules extend to various sectors, including e-commerce, social media, and sports organizations.
- Independent Oversight Mechanisms:
- The draft proposes establishing independent organizations to monitor individual consent, overseen by data controllers and regulatory authorities.
While the DPDP Act, 2023 specifies penalties of up to ?250 crore for data breaches, the draft rules themselves do not outline punitive measures for non-compliance. This omission has led to criticism and concerns about enforcement mechanisms.
Public Consultation and Next Steps
The draft has been made available for public comment on the MyGov website, with a deadline for submissions set for February 18, 2025. Citizens and stakeholders are encouraged to provide feedback, which will be reviewed before finalizing the rules.
Broader Implications
The DPDP Act aims to establish a robust framework for personal data protection in India, addressing privacy concerns in the digital era. However, the absence of explicit penalties in the draft rules raises concerns about the ability to ensure compliance and accountability.
Experts suggest that the lack of penal provisions could lead to significant debates during the consultation phase. The government?s approach will likely determine the efficacy of India?s personal data protection regime in the future.
