NEW DELHI: Millions of citizens going online will have guaranteed control over their digital data while social media companies such as Facebook and Instagram will need verifiable parental consent before onboarding children, or those under 18 years, with the govt finally notifying rules to operationalise the digital personal data protection (DPDP) law that was originally passed by Parliament in Aug 2023. The much-awaited rules promise a consent-based regime to safeguard the data of users who go online for social media, e-commerce, gaming, banking, payments and for availing of govt services. Companies and organisations violating the rules will face penalties, up to ₹250cr for serious failures to protect data, and breaches.
The rules also require companies to quickly inform users and the new data protection board about any data breach. However, these rules will be implemented gradually. The govt has given companies an 18-month window for transition, considering the big back-end changes they will need to undertake. Any breach must be promptly informed in “plain language, explaining the nature and possible consequences of the breach, the steps taken to address it, and contact details for assistance”, the govt said. New rules bar transfer of some data abroad It also said the law is guided by “seven core principles” – consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability. Regarding online data of children, where Big Tech and other major companies had been lobbying for a “liberal” approach, the new law mandates that companies must obtain verifiable consent before processing their personal data, with limited exemptions for essential purposes such as healthcare, education and real-time safety. “For persons with disabilities who cannot make legal decisions even with support, consent must come from a lawful guardian.”To obtain verifiable parental consent for processing a child’s personal data, companies must adopt appropriate technical and organisational measures “.
