The Indian government has rolled out a draft of the Digital Personal Data Protection (DPDP) Rules, inviting public feedback as part of the consultation process. The goal of these regulations is to bolster the protection of personal data by ensuring that data fiduciaries offer clear communication about data processing practices, allowing users to give informed consent.

According to the Press Information Bureau (PIB), the proposed rules empower citizens by granting them rights to erasure of their data, the ability to appoint digital nominees, and access to user-friendly data management tools. These measures are part of implementing the Digital Personal Data Protection Act, 2023, which aims to provide individuals more control over their personal information.

Under these rules, companies operating in India must adopt robust security protocols that include encryption, access control, and regular data backups. This is to guarantee the confidentiality, integrity, and availability of personal data.

Some specific provisions of the DPDP Act require that data fiduciaries:

• Establish mechanisms for detecting and addressing data breaches while maintaining logs.
• Report data breaches within a specified timeframe, including a detailed account of events leading to the incident.
• Dispose of unnecessary personal data after a three-year period and provide prior notice before erasure.
• Clearly indicate contact information for a designated Data Protection Officer (DPO) on their platforms.
• Obtain verifiable consent from guardians before processing the personal data of individuals under 18, with certain exemptions.

Additionally, organizations are mandated to conduct annual Data Protection Impact Assessments (DPIA) and audits for significant data fiduciaries, adhering to federal guidelines for cross-border data transfers as determined by a specialized committee.

The draft has also proposed safeguards for citizens regarding how federal and state government agencies handle their data, emphasizing lawful and transparent processing in line with legal standards.

Non-compliance with these regulations can expose organizations to significant penalties, potentially reaching up to ₹250 crore (around $30 million). The Ministry of Electronics and Information Technology (MeitY) is accepting feedback on the draft until February 18, 2025, promising confidentiality for all submissions.

This move follows the passage of the DPDP Act in August 2023, marking a critical step towards enhancing data privacy in India, driven by the recognition of privacy as a fundamental right by the Supreme Court in 2017.

The recent announcement aligns with earlier efforts by the Department of Telecommunications to enforce cybersecurity in communications through the Telecommunications (Telecom Cyber Security) Rules, 2024, which impose strict data breach disclosure requirements on telecom firms operating in the country.

Welcome to DediRock, your trusted partner in high-performance hosting solutions. At DediRock, we specialize in providing dedicated servers, VPS hosting, and cloud services tailored to meet the unique needs of businesses and individuals alike. Our mission is to deliver reliable, scalable, and secure hosting solutions that empower our clients to achieve their digital goals. With a commitment to exceptional customer support, cutting-edge technology, and robust infrastructure, DediRock stands out as a leader in the hosting industry. Join us and experience the difference that dedicated service and unwavering reliability can make for your online presence. Launch our website.