Insights Unveiled Takeaways from the Digital India Dialogue on Graded Compliance in the Digital Personal Data Protection Act 2023

In a significant step towards safeguarding digital privacy and personal data in India, the Ministry of Electronics and Information Technology convened the first-ever Digital India Dialogue on the Digital Personal Data Protection Act, 2023 (“DPDPA”) on September 20, 2023. This dialogue brought together various industry stakeholders to discuss the practical aspects of implementing the DPDPA, including the timeline and the roadmap for enforcement.

Recognizing the diversity in the level of digitization and data protection compliance maturity among organizations, the Ministry is considering a graded approach to compliance with the DPDPA.

1. Government Entities: Entities, particularly at the government and state levels, with lower levels of digitization will be granted extended transition timelines to adapt to the DPDPA regime. This approach acknowledges the complexities and scale of digitization within these entities.

• Start-ups and MSMEs: Early-stage start-ups, micro, small, and medium enterprises (MSMEs), and specific categories of organizations like healthcare institutions will also receive longer timelines for DPDPA compliance. This recognition of their unique challenges is a step towards ensuring a smooth transition without undue burden.

• Other Organizations: All other types of organizations will need to make a compelling case to the Ministry if they seek an extended transition period for compliance. This requirement emphasizes the importance of data protection and puts the onus on organizations to justify their need for additional time.

In addition to considering the type of organisation, the Ministry is also contemplating an approach for graded compliance based on the substantial engineering efforts required to implement certain DPDPA provisions. For instance, those entities mandated under the law to obtain verifiable parental consent for handling personal data of children (under 18 years), may be allowed more time for compliance.

In conclusion, the Ministry’s intent is crystal clear – to swiftly advance with the implementation of the Digital Personal Data Protection Act, 2023. This includes the formation of the Data Protection Board of India, the rule-making process, and the enforcement of the DPDPA. Organizations are encouraged to expedite their preparations to ensure compliance with this upcoming legislation.