How the draft rules for implementing data protection falls short

After a long wait of 16 months, the Ministry of Electronics and Information Technology has released the draft rules for implementing the Digital Personal Data Protection Act, 2023. Lack of detail The draft rules propose operative guidance for critical mechanisms such as notice and consent to a user for data collection and processing, intimation of data breaches, collection of parental consent on behalf of children, data localisation measures, and the procedure for setting up the Data Protection Board. Since the right to erasure may also impact a third-parties’ online speech, the draft rules could have articulated certain modes or conditions for objection that data processors could make against such an erasure request. To safeguard children, the DPDP Act obligates data processors to seek verifiable parental consent before accessing the personal data of children under the age of 18.