𝗧𝗵𝗲 𝗠𝗶𝗻𝗶𝘀𝘁𝗿𝘆 𝗼𝗳 𝗘𝗹𝗲𝗰𝘁𝗿𝗼𝗻𝗶𝗰𝘀 𝗮𝗻𝗱 𝗜𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗧𝗲𝗰𝗵𝗻𝗼𝗹𝗼𝗴𝘆 has released #draft rules under the 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗗𝗮𝘁𝗮 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗔𝗰𝘁. These rules have been eagerly anticipated since the #Act was passed in August 2023. The Government is now inviting #feedback on the draft rules via the #MyGov portal, with the deadline set for #February 18, 2025. #dpdprules #dpdpa #dataprivacy #PrivacyRights #DataProtection #Privacy #DPDPA https://lnkd.in/gMSry55R
Draft DPDP Rules out for consultation at last! Link to the Rules in the comments. Here are some key issues addressed in the Rules: ✳️ Requirements in privacy notices - a detailed list of personal data being processed, mapped to the purpose for processing, is specifically mentioned; ✳️ Parental consent verification for processing data minors and exemptions from this requirement in certain cases including for child care centres, educational institutions and for providing health services to children; ✳️ Requirements and registration of consent managers - consent managers are required to avoid conflicts of interest, which is commercially significant; ✳️ When a specified purpose is deemed to no longer be served (i.e., akin to a default retention period in certain cases); ✳️ Reasonable security safeguards - encryption, access control, logs are all mentioned; ✳️ Requirements for breach intimation - both to data principals and the Data Protection Board, with the possibility to request a time extension for reporting details to the Board; ✳️ Additional obligations for significant data fiduciaries: Annual DPIAs and audits, with a report containing significant obligations on these to be submitted to the Data Protection Board; and ✳️ International transfers/processing of personal data outside India - watch for requirements that may arise on disclosing personal data of Indian residents to foreign authorities. Some hits, some misses and some silences as well. Detailed analysis to follow by Poovayya & Co. in some time! #DPDPRules #dataprotection #India