Govt releases draft rules for digital personal data protection

The centre on Monday released draft Digital Personal Data Protection Rules intended to safeguard citizens’ right to protect their personal data. 

These rules will operationalise the Digital Personal Data Protection Act, 2023 (DPDP Act), empowering citizens with a robust legal framework for protecting digital personal data.

The rules define the rights of citizens in simple and clear terms so as to empower citizens safeguard their right to protect personal data in a rapidly growing digital economy. 

The DPDP Act also seeks to achieve the right balance between regulation and innovation, so as to address issues like unauthorised commercial use of personal data and other data breaches.

The rules require fiduciary intermediaries to provide clear and accessible information about how informed consent is obtained and personal data is processed.

Citizens can demand erasure of data and appointment of digital nominees, as also availability of user-friendly mechanisms to manage their data.

The rules empower citizens with greater control over their data, including the right to erasure and grievance redressal. Besides, it empowers parents and guardians to ensure online data security for their children.

In order to strike a balance between innovation and regulation, the rules try to lessen compliance burden on small businesses and startups by giving them a grace period so as not to hamper a smooth transition from small businesses to large corporates.

The rules prescribe a “digital by design” Data Protection Board for consent mechanisms and grievance redressal, for faster resolution of complaints and grievances online.

The Board will consider the nature and gravity of defaults while imposing penalties. The rules also provide for data fiduciaries to voluntarily give undertakings to avoid wrong doing at any stage of proceedings, to ensure a fair adjudication process.

There is also provision for annual impact assessment and audit of data protection for major data fiduciaries.

The draft rules have been framed after wide range of consultations with stakeholders and are based on global best practices.