Data protection rules likely to be released for public consultation this month

.

The rules that will make the digital personal data protection (DPDP) law operational are ready and will be released for public consultation by the end of this month, sources close to the development have said.

"DPDP rules are ready, drafting has been completed. It will be released for consultation before the end of September and consultation period will be more than a month," a person aware of the matter told Moneycontrol.

The DPDP Bill was passed the Parliament nearly a year ago but India's first data privacy law, which brings safeguards to prevent personal data breaches, has still not yet been implemented as many provisions require additional rules.

The law provides specialises protections for children and persons with disabilities, among others. It defines a child as someone below the age of 18 and Section 9 of the Act mandates that such children have to be verified and parental consent required before processing the data of a minor.

Earlier, in an interview to Moneycontrol, IT ministry secretary S Krishnan had said notifying the DPDP (Digital Personal Data Protection) Act’s rules quickly was a "priority" for the Modi 3.0, which completed 100 days on September 17.

What could the DPDP rules have

Exemptions on the processing of children's data: The government may exempt educational institutions, health establishments, and certain government entities from restrictions on processing of children's data mandated in the DPDP Act

Data breach and data protection board: Any platform processing personal data, whether a private or government entity, must immediately notify the Data Protection Board (DPB) of any breach on getting to know of it.

Onus on platforms to ensure consent: When taking permission to process data of children or disabled persons, the onus may be on platforms to ensure that consent is obtained from the child's parents or legal guardians and the same should be verified with the help of government-mandated IDs.