Industry likely to get six months to align with data protection rules

Chandrasekhar says rules for DPDP Act ready, consultations to begin after G20

The government may give around six months to industry to align with the Digital Personal Data Protection (DPDP) Act, Minister of State for Electronics and IT Rajeev Chandrasekhar said on Monday.

However, the actual transition time will be decided after consultation with stakeholders, he said during a fireside chat session with students at Delhi University. When asked about when these consultations will take place, the minister said: “Very soon, after the G20 (summit).”

“We certainly look at a transition as the shortest possible time required for a meaningful transition so there is no disruption. We recognise that there is a move from our existing regime of data protection to a new, much stricter regime. There is industry (representation) that has come to us and asked us for a transition period and we are open to considering that,” the minister said on the sidelines of the event.

Chandrasekhar said the government was ready with all rules and ready to notify the Data Protection Board soon.

The minister said the migration to the new regime should not lead to any disruption in the businesses.

“We may give a certain amount of time for platforms to migrate, to have consent managers, redesign their consent form, make sure data processing is aligned to the act...we will not give them two years. It will be some number, six months or something like that so that transition is orderly,” Chandrasekhar said.

Parliament last month cleared the law on digital data privacy after four years of work, rounds of deliberation, and multiple iterations. Digital platforms will need to take unconditional, free, specific, and informed consent from users presented in clear and plain language for processing their data. Users will be able to withdraw this consent at any point post which the platforms must stop processing their data and erase it.

Every platform will need to provide a notice explaining the purpose of data processing and the rights of the users. The notice has to be made available in all 22 official languages. The platforms that have already collected personal data will need to send a notice to users allowing them to withdraw their consent. The Act provides broad principles of data protection, but the way of implementation and the exact processes will be “as may be prescribed” in the rulebook.

“The only way to have a flexible law that can evolve with the (technological) changes that will happen, is to have the ability to create subordinate legislations, which will also be tabled in the parliament, but will be a faster process,” Chandrasekhar said.