Centre Notifies Draft Rules for Digital Personal Data Protection Act

What is the Digital Personal Data Protection act?

The Digital Personal Data Protection Act proposes to make parent’s verifiable consent and identification mandatory for the creation of a child's user account on online or social media accounts.

What does the draft rules say?

The draft rules seek to make parental nod essential for processing of personal data of children.

The draft rules says the parents’ identity and age will be validated and also verified through identity “issued by an entity entrusted by law or the government.”

For Processing personal data of child, “A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India..."

This requirement necessitates the provision of reliable details of identity and age, either directly from the platform or entity itself, or through voluntarily shared details of identity and age, or a virtual token linked to the same, issued by an entity authorized by law or the government.

"The parent may voluntarily make such details available using the services of a Digital Locker service provider," it said.

Rules states that the entities will be able to process personal data only if individuals give their consent to consent managers, who are entrusted to manage records of consents of people

Industry watchers pointed out that draft rules hint at additional oversight other than permitting cross-border data sharing, except to blacklisted jurisdictions. The draft rules state that: "A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government on the basis of the recommendations of a committee constituted by it is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India."