'To be released in…': Ashwini Vaishnaw on Digital Personal Data Protection Rules

The rules for the Digital Personal Data Protection (DPDP) Act, 2023 that is expected for quite some time now has been informed to be in the process of preparation for release in the next month. This was announced by the Union Minister Ashwini Vaishnaw on Monday. This was after the Act was enacted by the parliament on August 9, 2023 after the Supreme Court declared that right to privacy is part of the Constitution.
 
He also informed that the structure of the DPDP Act is Digital by default, it is a completely digitized Act prepared by the Digital India Corporation DIC and National Informatics Centre NIC. This framework shall act as the guide to reduce the level of frustration associated with the complaint and appeal process, and any other interaction with platforms, to the lowest level possible in the view of the user.

He said, “One of the major innovations that we did in the DPDP Act was that it should be digital by design, and it should be born digital. The entire implementation structure has to be digital right from the beginning. That entire digital framework has now been completed from inception, and is now fully operational.” He further explained that the digital infrastructure has passed the testing stage.

After draft rules have been made, there shall be a period of between 45- to 60 days allowed in which stakeholders can inform the observers. As per Vaishnaw, the government is looking to increase and decentralise consultation by inviting legal professionals and technology and data experts.

The other significant part concerning the DPDP Act relates to the collection of children’s data and states that the platform is allowed to collect the data of users under the age of 18. Only having obtained the legally binding consent of their parents or legal representatives. This has given rise to much discussion during the consultations leading to this Regulation, although officials have noted that this has been well addressed.

As provided in section 9 of the DPDP Act. The data fiduciary is required to ensure that consent for processing any personal data of a child, or an individual with disability and having a legal guardian, has been obtained before the processing takes place.

While the government is set to release these essential regulations, the DPDP Act is set to cause a paradigm shift in the manner in which personal data is processed and protected in India and ensure that data is not misused while creating a safe user environment online.