The government on Wednesday said that companies/entities may be given around a year’s time, and even some more to smaller organisations or startups, to comply with norms of Digital Personal Data Protection (DPDP) Act, 2023.
Speaking on the sidelines of consultation session with the industry stakeholders, Rajeev Chandrasekhar, Minister of State for Electronics and IT told reporters that Data Protection Board and guidelines for the eight-nine ‘key rules’, including consent management, will be put in place within a month.
“Industry wants some more time for age-gating, different timelines for transition for different data fiduciaries. We expect transition for most of the rules except age-gating will happen in 12 months from now,” Chandrasekhar said.
Also Read | The unfolding trajectory of India’s journey in data privacy regulation
He said timelines for each category of entities would be given accordingly – some could be less than a year also and some could be more than a year – depending on the size of the organisation.
“We will start putting in place most of the rules for compliance in the next five-six days…most of the rules will be placed within 30 days. The Data Protection Board will also be in place in 30 days,” Chandrasekhar added.
However, a senior official at Ministry of Electronics and IT (MeitY) said that rules may come in ‘altogether also’ at one go once consultations are over.
“The DPDP Act was already published by the Gazette of India on August 11 so the companies should already start acting on it…they should prepare themselves from then itself already,” said the senior official adding that some companies asking for five years’ timeline was ‘surprising’.
The Digital Personal Data Protection Act, 2023, which comes six years after the Supreme Court declared ‘Right to Privacy’ as a fundamental right, has provisions to curb the misuse of individuals’ data by online platforms.
The Act seeks to protect the privacy of Indian citizens while proposing a penalty of up to ₹250 crore on entities for misusing or failing to protect the digital data of individuals.
The Act mandates that the data collected by citizens should be used as per law, only for the purpose for which it has been collected, and the quantum of data should be limited to the requirement.
In case of any grievances, individuals will be able to approach the Data Protection Board which will process the complaint as per the norms of the Act.
The consultation was attended by around 125 people representing various companies and industry bodies including Meta, Lenovo, Dell, Netflix, Paytm, Microsoft, Ficci, Broadband India Forum, MediaNama, among others.
Commenting on the consultation session, TV Ramachandran, President at Broadband India Forum told businessline, “The discussions were fruitful and very much welcome…some critics were also there, but such comments would also come as it is a vast topic.”