THE Government has released the long-awaited draft of Digital Personal Data Protection Rules, which do not mention any penal action for violations. The draft rules have been issued after Parliament approved the Digital Data Protection Bill 2023 about 14 months back. The draft rules, which have been published for public consultations, will be taken into consideration for making the final rule after February 18. The draft is available on the MyGov website for public comments. The rules have spelt out a mechanism for obtaining explicit consent from individuals and mandate parental consent for children to use their data in any form.

 

The Digital Personal Data Protection (DPDP) Act 2023 describes entities collecting and using personal data as data fiduciaries. “A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child,” the draft rule said. As per the draft, the data fiduciary will have to carry out due diligence to check that the individual identifying herself as the parent of a child is an adult and identifiable if required in connection with compliance with any law in force in India. According to the draft rules, data fiduciaries will have to keep it only for the time being for which consent has been provided. E-commerce, social media and gaming platforms will fall under the category of data fiduciaries. The draft rules have not mentioned penalties that were approved under the DPDP Act, 2023. The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries in case of personal data breach.