The federal government is not going to prolong the implementation timelines for the Digital Private Information Safety (DPDP) Act, 2023, MeitY Secretary S Krishnan stated at an business session in Bengaluru, urging startups to start compliance preparations immediately.
Talking just about at a “Information Privateness Compliance Clinic” organised by Startup Coverage Discussion board (SPF), Krishnan stated the notified timelines would maintain and that no extension was into consideration. He additionally urged corporations to begin their compliance work now quite than defer preparations.
The session introduced collectively round 30 SPF member corporations, together with Groww, Razorpay, Pine Labs, Meesho, CRED, Acko, SQ1 Safety, Snabbit, Payglocal, Fam, Pronto, XFlow, Dezerv, Scaler, LenDenClub and Gullak, amongst others.
Krishnan stated the DPDP framework has intentionally been designed round rules quite than prescriptive necessities. This strategy permits corporations to construct compliance programmes primarily based on the character of non-public knowledge they course of and the dangers related to such processing, he stated.
The session was additionally addressed by Vikash Chourasia, Scientist ‘D’, MeitY, and Amar Patnaik, former Member of Parliament and a member of the Joint Parliamentary Committee that examined the info safety laws. Patnaik supplied context on the legislative course of and the extent to which particular person use instances have been examined earlier than the framework was finalised.
Startups sought readability on a number of sensible elements of compliance, together with the chance of “consent fatigue” and person drop-off throughout consent assortment, the excellence between behavioural monitoring and bonafide processing, and the edge for notifying private knowledge breaches.
The usage of private knowledge for coaching synthetic intelligence fashions additionally emerged as a key concern. Firms raised questions on implementing entry and erasure requests at scale, whether or not account aggregators might act as consent managers and cost charges for such companies, and the way legacy knowledge must be handled, together with whether or not contemporary consent could be required.
Shweta Rajpal Kohli, President and CEO, SPF, stated the Ministry’s message was clear that the timelines would maintain and corporations ought to begin constructing their compliance methods now.
“The framework is principle-based, which supplies our members room to design compliance that matches their enterprise, however that flexibility solely helps those that begin early,” Kohli stated.
In the meantime, SPF will collate the problems raised in the course of the session and take them up with MeitY as a part of its ongoing engagement on the implementation of the DPDP framework. AP & Companions have been information companions for the session.
