Key Points from Digital Personal Data Protection Act of 2023 (DPDP)
The DPDP Act of 2023 mandates significant changes in the way data is handled, particularly focusing on children and data breaches.
Children's Privacy and Social Media Access
- Children under the age of 18 require verifiable parental consent to access social media.
- This regulation is aimed at protecting minors from unauthorized data usage.
Data Fiduciaries Classification
- Data fiduciaries are categorized into ecommerce companies, gaming intermediaries, and social media firms.
- These entities must delete personal data of inactive users after three years.
Data Breach Protocol
- Data fiduciaries must report data breaches to the Data Protection Board within 72 hours.
- Users must be informed of breaches in a concise, clear, and plain manner.
- Details provided should cover the nature, extent, and impact of the breach, along with risk mitigation measures.
Data Localisation and Protection Measures
- Future data localisation requirements may be introduced for significant data fiduciaries.
- Significant data fiduciaries are required to conduct an annual data protection impact assessment and audit.
Stakeholder Involvement and Comments
- The draft rules are open for stakeholder comments until February 18.
Expert Opinions
- Aparajita Bharti noted the draft gives direction for implementation and raised concerns about potential data localisation.
- Nehaa Chaudhari highlighted the flexible approach to parental consent as beneficial.