India Readies Overhauled National Data Privacy Rules

The government of India has drafted rules that will define how companies inside and outside of the country must handle its citizens' data privacy.

A year and a half ago, India enacted its first ever comprehensive national data protection law: the Digital Personal Data Protection (DPDP) Act. The act defined key privacy rights for Indian citizens — to access, update, correct, challenge, port, and erase their data, plus additional safeguards for children's data — and various obligations of data stewards to secure user data, maintain its accuracy, limit how it's used, and more.

Organizations have not yet been forced to adjust their data trafficking practices, as the act was waiting on a set of clearly defined rules of implementation. On Jan. 3, India's Ministry of Electronics and Information Technology (MeitY) released those draft rules, designed to operationalize DPDP. In 22 provisions and seven schedules, the DPDP Rules provide businesses with a framework for complying with the act once the government begins to enforce it.

For years leading up to this point, "As the digital infrastructure in India has grown exponentially, the absence of safety mechanisms for individuals has left citizens vulnerable," says Pankit Desai, CEO and co-founder of Sequretek. That makes DPDP "a landmark regulation, long overdue. It's not just a regulatory framework — it is a signal of India's readiness to prioritize citizen welfare in the digital age."

India's Long Road to Data Privacy

In 1941, Khrarak Singh, a citizen of India's northern state of Uttar Pradesh, was tried for gang robbery (dacoity). He was let off thanks to an absence of evidence, but police kept an eye on him nonetheless. They visited his home at night, kept tabs on his movements, and monitored various aspects of his personal life: his employment, social life, and habits, for example.

Eventually Singh filed a petition, arguing that the surveillance violated his constitutional rights. On Dec. 18, 1962, six judges of India's Supreme Court ruled that though some of the police tactics amounted to harassment, many of their surveillance measures were legally permissible. Privacy, they argued, was not a fundamental right under the country's constitution.

That remained the case until 2017, after India's government proposed the "Aadhaar" project, giving all citizens identification numbers backed with various demographic and biometric data. Overseeing a challenge to Aadhaar, Chief Justice of India JS Khehar explained, “It is essential for us to determine whether there is a fundamental right to privacy in the Indian Constitution," citing the Kharak Singh case. In August 2017, a nine-judge bench declared that privacy was a right given to India's citizens under its constitution.

Their ruling opened the floodgates to data protection legislation, first and most notably the proposed Personal Data Protection Bill of 2019. However, the bill was proved both expansive and restrictive. The bill covered both personal and non-personal data, but was stringent in mandating that sensitive personal data not leave the borders of the country, yet also lenient in allowing the government to exempt itself for various reasons. Regardless, the bill was withdrawn in August 2022. It was followed in spirit by the more neutral DPDP, which will finally become operational once the latest proposed rules are finalized.

New Rules of the Road

The DPDP rules are mostly industry standard: companies must notify customers about the data they collect, and if it's breached, encrypt it at rest and in transit, delete it after three years of inactivity, and so on.

"Most notably, they grant substantial control to the data principal (individual) over their personal data, including the ability to determine when, how, where, and for what purpose their data is used," notes Rama Krishna Gudipati, head of customer success at CloudSEK. "Additionally, the introduction of penalties for non-compliance adds an important layer of accountability." Failing to notify customers of a breach, for example, or betraying obligations around children's data, could cost companies up to INR 200 crore (around $23 million).

Certain provisions are more debatable, though, like the continued exceptions afforded to government agencies. Sequretek's Desai says that "The exemption granted to the government from these rules raises questions about fairness and accountability, especially given the government's significant role as a service provider," says Sequretek's Desai. "India's digital infrastructure is heavily influenced by government-led initiatives, unlike in the West, where private enterprises dominate," making the rule more impactful than it would be in other countries.

The deadline for submitting feedback on the new draft rules is Feb. 18. After the rules are activated, MeitY stated in a Jan. 5 press release, "An adequate period would be provided so that all stakeholders, from small enterprises to large corporates, may transition smoothly to achieve compliance with the new law."