The government on Friday notified rules for the Digital Personal Data Protection (DPDP) Act, operationalising India’s first digital privacy law. The new rules give companies and other stakeholders up to 18 months to comply with the administrative guidelines under the Act. Consent managers have up to 12 months to register to act on behalf of users.
Under the new rules, social media and internet intermediaries, as well as any other companies that deal in user data, must provide data principals, or users, with an itemised description of their personal data to obtain their consent and specify the purpose for which their data will be used.
Companies must also allow users to easily withdraw their consent for the processing of personal data or file a complaint with the Data Protection Board if they believe the platform has violated their rights.
To act as a consent manager, a company registered in India must apply to the Data Protection Board (DPB) and fulfill the conditions as notified by the DPB from time to time. A consent manager must fulfill all obligations at all times; failing to do so, the registration of the said company or person may be suspended by the DPB.
The DPB, which will operate entirely digitally and be based in New Delhi, will have four members, including a Chairperson.
The new rules also classify digital intermediaries based on the nature of the service provided by them and have set separate timelines by which these platforms must delete the user’s personal data “unless its retention is necessary for compliance with any law for the time being in force”.
In the event of a data breach, the data fiduciary shall notify the data principal or user, as well as the DPB, of the violation within 72 hours of becoming aware of it. The data fiduciary shall inform the user of the description of the breach, its nature, the extent and the timing of its occurrence, the consequences of the data breach, the measures being implemented to mitigate the risk, and the safety measures to be taken by the user to protect themselves.
