Meity may cut compliance timeline for key DPDP rules to 12 months

Proposed move to shorten implementation time to 12 months from 18 months is likely to face resistance from industry players

The Ministry of Electronics and Information Technology (Meity) is likely to shorten the implementation timeline for certain provisions under the administrative rules of the Digital Personal Data Protection (DPDP) Act for significant data fiduciaries (SDFs) to 12 months from the earlier 18 months, sources told Business Standard. 

The changes were proposed by the ministry during a stakeholder meeting on Thursday, the sources said. 

Big-tech companies and social media intermediaries, such as Meta, Google, Amazon, and Microsoft, along with most major banking, financial services and insurance institutions, will fall under the SDF category. 

The proposed move is likely to face pushback from industry players, who have been seeking relaxation on the 18-month deadline, citing the complexity of India’s data landscape, the sources added.

 

“They have proposed to cut down the timeline by almost a third, which will be very difficult for not just us but any data fiduciary operating in India,” an industry executive said, asking not to be named. 

An email sent to the ministry seeking its response to the proposed changes did not elicit any response until press time.

 

Under the DPDP Act, the central government may notify any company, intermediary, or class of internet intermediaries as SDFs based on an assessment of various factors. These include the volume and sensitivity of personal data processed, risks to the rights of data principals, potential impact on India’s sovereignty and integrity, risks to electoral democracy, national security, and public order.

 

The ministry has also proposed that the DPDP Act provision empowering the central government to seek information from a data fiduciary or internet intermediary be implemented immediately, rather than the 18-month timeline granted earlier.

 

Under the DPDP Rules, the ministry has allowed the transfer of personal data outside India, subject to restrictions and requirements mandated by the government from time to time. These restrictions and requirements were earlier to be decided by a government-appointed committee, with an 18-month period given for implementation of both provisions.

 

The ministry is likely to propose immediate implementation of this provision as well, according to a source who attended Thursday’s meeting.

 

The government, under the DPDP Rules, has mandated that data fiduciaries retain personal data, associated traffic data, or processing logs for a minimum period of one year, after which such data may be erased unless otherwise specified.

 

While this requirement was earlier slated to be implemented within 18 months, the government is now likely to propose that it be operationalised within 90 days of the amended rules being notified in the Gazette of India, another source said.

 

The DPDP Rules, notified in November last year, operationalised India’s first comprehensive digital privacy law, which had been under discussion in various forms for more than a decade.

 

In November, Union IT Minister Ashwini Vaishnaw had said the government was in talks with industry stakeholders to compress the compliance timeline under the DPDP Act from 18 months to 12 months.

 

“We are in touch with the industry to further compress time required for compliance because... exactly the same argument we have given to the industry that you already have a compliance framework which is existing in other geographies... why can't you replicate...,” Vaishnaw had then said.