Data privacy rules to be issued for consultation shortly: Rajeev Chandrasekhar

Industry stakeholders will get four weeks for the consultation process, with the ministry of electronics and information technology (Meity) setting a tentative deadline of 31 January to notify the DPDP rules.

The rules will include offering details on “consent management, age-gating and other areas," Chandrasekhar said. He added that companies and government agencies will get sufficient time to comply with the rules. 

“For big tech, we have advised on offering a six-month window to comply with the rules. For government bodies and small companies, a window of 12-18 months could be given to comply with the rules," he said.

On 14 September, Mint reported that Meity was considering a graded approach to allowing companies to comply with the impending DPDP rules.

Chandrasekhar, on this note, said consent is fundamental to the DPDP Act, which has been aptly represented in the upcoming rules.

“The consent mechanism will be simple, multilingual, audio-based... It will be easy to understand. It will also not be in the agreement-based consent forms that we see today—it will have clear do’s and don’ts that offer a clear link to click on if a user wants to withdraw consent. The same will apply for reporting grievances," the minister said. 

“This will make for a very simple, clear and obvious framework, because our internet users are not only urban or erudite in law. The rules are aimed at making it easy for people to understand what their rights are, and the rules have specified that in a very detailed manner," he added.

Chandrasekhar also said the rules will specify clear definitions for age-gating, used to verify a user’s age for allowing access to restricted content. 

“We’ve proposed a solution for it based on a KYC model, but we’re leaving it to platforms to determine their own ways of doing age-gating if they have another way for it," the minister said.

Alternative age-gating mechanisms will be accepted, he said, “as long as the companies understand that they have an absolutely unambiguous obligation that they cannot process a child’s data without verifying their age, and therefore, getting a consent from their parents."

Platforms, which will include the likes of Meta’s Instagram and Google’s YouTube, will “have the obligation to keep repeating and reminding a user of their rights."

Meity has held steadfast that large tech companies already follow compliance with global data protection and privacy legislation, such as Europe’s General Data Protection Regulation (GDPR). As a result, they should not need more time than what has been stipulated under the upcoming rules to achieve compliance.

So far, big tech executives have said that companies have already begun working to achieve compliance with India’s DPDP Act. In an interview with Mint on 28 September, Nick Clegg, president of Meta’s global affairs, said the company is already working towards ensuring compliance.

“The devil is in the details here. Of course, we can implement existing solutions that we already have faster than creating bespoke India-specific solutions," Clegg said. “Our India team is working with government stakeholders to implement the legislative recommendations under the DPDP Act as rapidly as we can, based on the expectations that have been set for us."

He, however, said this would depend massively on specific aspects of the law.

“Some aspects are easier to comply with than others since we’d have also dealt with some aspects in other geographies. Where the adaptations to the Indian law are not very extensive, these aspects would be more complicated," Clegg said.

While the DPDP rules near their notification timeline, discussions on the Digital India Act have been deferred for the next government, Chandrasekhar said, adding that the consultation process for the upcoming law could not be adequately completed in time.

India is due for its national election in April-May.