The confident announcement by the Minister Mr Ashwini Vaishnaw that the DPDPA notification would be released well before the end of this month has raised the expectations of the industry that at last DPDPA is set to become operational. The draft rules which were published on 3rd January 2025 and it is reported that 6915 public views were received. Copy of the views presented by us is available here.
Media was more interested in the controversies related to the amendment to RTI act which however was not an issue for the industry in general. Industry was concerned about the date from which the penalties would apply. This required a notification on Section 33 of DPDPA along with Section 44 (2). The draft rules of January 2025 were silent on this aspect. We now look forward to the new notification to provide clarity on this aspect.
The second most important missing component in the draft rules was about how organizations will determine if they are “Significant Data Fiduciaries” or not. In the absence of specific guidance, we interpreted that the industry players have to make a self assessment of their risk profile and decide if they are significant data fiduciaries and accordingly decide on the appointment of DPO, Data Auditor , conduct of DPIA etc.
Similarly the draft had its own contradictions related to “Consent Managers” about which the industry is yet to fully get clarity.
FDPPI however provided clarity through the framework DGPSI and has now extended the framework to the use of AI in personal data processing by Data Fiduciaries through the extended framework DGPSI-AI.
As we look for the new notification to provide clarity officially , several privacy advocates are waiting to launch a challenge in the Supreme Court to bring a stay on the Act if possible during the current CJI’s tenure itself and are going to search for some reason to launch the legal battle.
We at FDPPI are however focussed on what the industry should do. Our next interaction with the industry is the IDPS event on September 27, at Chennai in association with MMA, at the MMA Management center in Thousand Lights. We expect that the rules would have been notified by that time.
FDPPI recognizes that in every seminar, the dignitaries on the stage are often at a level higher than the participants and the panel discussions tend to go at a level which leaves many participants impressed but not necessarily wiser. To avoid such a situation when the information about the subject of the discussion is fast evolving, FDPPI has proposed to conduct a Curtain Raiser event virtually on 22nd September 2025 to the members of MMA and other registrants of the program on September 27, to appraise them about the theme of the conclave namely “Bracing the twin challenges of DPDPA and AI”. In case Meity is able to publish the rules before that time, it will be the first occasion when the new rules would be discussed in such a public forum.
We may recall that the first discussion on DPDPB 2021 was also held in Chennai when on the previous evening of a pre-arranged seminar, the draft Bill was published and we got an opportunity to discuss this in Chennai.
The September 22 event would be a 90 minute session between 6.00 to pm 7.30 exclusively for the members of MMA and would also be open to registrants of the September 27 event. (In case you want to register, please register here).
Also Refer:
Naavi
