The Ministry of Electronics and Information Technology (MEITY) will release the draft rules for the Data Protection and Privacy (DPDP) Act for public consultation immediately following the Budget session of Parliament, sources have informed CNBC-TV18.
The drafting of these rules has been completed and they will soon be available for public comment, the sources said.
The DPDP Act, ratified in August 2023, has been in suspended animation, pending the finalisation of these rules.
The draft rules are being introduced nearly 12 months after Parliament approved of the Act.
MEITY will open a 30-45-day window for public feedback on the draft rules, sources said.
The forthcoming rules are expected to provide clarity on several key aspects:
- Appointments and Working of the Data Protection Board (DPB): Detailed guidelines on the structure and functions of the DPB.
- User Complaints: Procedures for users to raise complaints with the DPB.
- Appealing DPB Decisions: Processes for appealing decisions made by the DPB.
- Data Access Requests: Methods for users to request data collected by Data Fiduciaries.
- Data Deletion Requests: Procedures for users to request the deletion of their data by Data Fiduciaries.
- Data Erasure Timelines: Timeframes for Data Fiduciaries to erase personal data if consent is withdrawn.
- Grievance Redressal Timelines: Timelines for addressing user grievances.
- Parental Consent for Minors: Guidelines for obtaining parental consent in the case of minors.
- Breach Notifications: Requirements for Data Fiduciaries to inform users in the event of a data breach.
- Consent Managers: Technical, operational, and financial conditions for Consent Managers.
The release of these draft rules aims to operationalise the DPDP Act, providing a clear framework for data protection and privacy in India.
