Unboxing the DPDP Rules - What Changes and First Thoughts

1. What are the implementation timeline for DPDP Rules?

DPDP rules must be implemented in phases over a timeline of 18 months, with some rules taking immediate effects, while the others in 12 or 18 months. The DPB framework and provisions need to be implemented immediately while the consent manager related requirement must be fulfilled within 12 months. Full functional compliance of DPDP Rules must be implemented within 18 months.

1. What are the penalties for non compliance?

To ensure businesses take data privacy seriously, government has mandated a maximum penalty for single instance of non-compliance to go upto INR 250 Crores.

1. What does implementing data principal rights mean?

Data Principal Rights mean letting users access, review and withdraw consent, request erasure, and raise complaints. They can also publish DPO details and set up a ticketing process.

1. What are the Significant Fiduciary requirements, that businesses need to meet?

If you're a Significant Data Fiduciary, you need to conduct annual audits, ensure algorithms don't infringe user rights, and restrict cross-border data transfers.

1. What are the data localisation requirements for cross border data transfers?

The DPDP Rules states that data localisation requirement for cross border data transfers is a “blacklist” mechanism which is in line with the provisions of the DPDP Act. Businesses must have updated data mapping at all times in order to be able to restrict data transfers that fall under the blacklist.