The Ministry of Electronics and Information Technology (MeitY) has announced plans to extend the consultation period for the draft Digital Personal Data Protection (DPDP) Rules, following a high-level consultation session attended by over 300 industry stakeholders. The session, held at the India Habitat Centre, was led by IT Minister Ashwini Vaishnaw and Secretary S. Krishnan, alongside other senior officials.
Minister Vaishnaw emphasized the government’s commitment to balancing innovation and regulation, stating, “The objective was to keep the rules simple and not prescriptive. We will get the right balance between innovation and regulation. The government will have a series of focused consultations with organisations.”
Key Concerns Raised by Stakeholders
Prominent companies, including Meta, Google, Snap, ShareChat, and OpenAI, alongside industry bodies such as Nasscom, IAMAI, DSCI, The Software Alliance, Ficci, and the Broadband India Forum, raised several concerns during the session. Among the key points discussed were:
- Children’s Data Restrictions: Stakeholders questioned the practical implementation of the proposed identification system for children and its implications.
- Consent Manager Mechanism: Industry representatives sought clarity on the operational details of the consent management framework.
- Data Localisation and Transfers: Attendees raised concerns over the data localisation requirements, highlighting potential conflicts with international regulations and the impact on cross-border data flows.
- Cyber Incident Reporting: The proposed requirement to report all “cyber incidents” to the Data Protection Board was flagged as potentially burdensome. Stakeholders recommended a risk-based threshold for such reporting to ensure practical compliance.
An attendee noted, “The data localisation requirements can potentially clash with regulations of other governments, and that is something very concerning for the industry.”
Commitment to Comprehensive Dialogue
Minister Vaishnaw assured stakeholders that their feedback had been noted and that the consultation process would be extensive. He stated, “The architecture required will be fully digital in implementation. That’s why we delayed the publication of rules because we wanted the architecture in place.”
Next Steps
The consultation period, originally scheduled to end on February 18, will now be extended to accommodate additional focus group discussions on specific aspects of the regulation. These discussions aim to address industry concerns and refine the rules to ensure they are practical, balanced, and conducive to fostering innovation.
The DPDP Rules mark a significant step in India’s journey towards robust digital governance, and the government’s open approach to stakeholder engagement is expected to yield a framework that supports both data protection and economic growth.
