THE LONG ROAD TO DATA PROTECTION

The DPDP Act comes with a long gestation period. What does that mean for its efficacy?

- SURAJEET DAS GUPTA

Nearly seventeen months after Parliament cleared the much-debated Digital Personal Data Protection Act (DPDP) 2023 and the President gave assent to it, the ministry of electronics and information technology (Meity) last week released the draft rules for its implementation. But the Act, which is meant to balance regulation and innovation while protecting citizens' rights, is still some way from becoming reality. MeitY has given 45 days for public consultation on the guidelines: Till February 18.

MeitY Minister Ashwini Vaishnaw said he expected the final rules to be placed in the Monsoon Session of Parliament, after which digital entities will get two years to adapt their systems to comply with the new law. So, if everything goes well, they have time till July 2027 or so.

Many experts and advocacy groups say the long period of gestation has made the new law less effective. With more time still to go for its implementation, citizens will be left to fend for themselves with little redressal for data breaches.

The government says the time taken was required, because the industry wanted extensive consultation. In addition, there was no global reference point, except the stringent European rules for data protection. So India had to work its way from the ground up.

Global tech players agree, saying the Act that was passed was certainly a big improvement over its earlier iterations. So broader consultations did help. Yet, at a broader level, many are concerned over the two more years that MeitY is willing to give digital companies, instead of adopting the graded approach it had earlier put in place for implementation.