Govt May Trim Compliance Timelines for DPDP Rules: IT Minister

IT minister Ashwini Vaishnaw yesterday said that the Centre is in talks with industry stakeholders to “compress” the 18-month timeline for compliance with the recently-notified Digital Personal Data Protection (DPDP) rules.

Responding to a question during a media briefing, Vaishnaw also said that the government may trim the timelines via amendments once the Data Protection Board has been established, signalling a potential faster rollout of the new privacy regime.

For context, DPDP Rules provide an 18-month phased timeline for companies, especially big tech giants, for transition to the new regime. The norms also require data fiduciaries, like Google and Meta, to issue simple consent notices that explain the specific purpose for which personal data is being collected and used. 

Citing his rationale, the minister said that many large companies were already complying with stringent norms elsewhere, questioning why these compliance models couldn’t be replicated in the country. 

“We are also in touch with the industry to further compress the time which is required for compliance because… you (big techs) already have a compliance framework which is existing in other geographies. Why can’t you replicate this? And they are quite positive on this. So,… once the data protection board is put in place and a complete digital framework… is rolled out, we’ll have further amendments in the rule so that we can compress the timelines,” added Vaishnaw. 

Noting that the new legal framework for the digital realm was essential for protecting society from the challenges posed by disinformation and deepfakes, the minister, as per Economic Times, also underscored the need for incorporating expert contributions and robust techno-legal measures to effectively address the nuances of the digital world.

“The way digital technologies and new opportunities are coming up, protecting the interests of citizens and the coming generations, is of utmost importance,” the minister reportedly added. 

The development comes barely days after the IT ministry notified the DPDP rules, 2025 to oversee the use of personal data by digital companies. The norms protect personal information by setting standard procedures for collecting, accessing and safeguarding the data and underline the obligations of data-handling entities.

As per the new rules, the Centre will set up a Data Protection Board, which will enable citizens to file and track complaints online through a dedicated platform and mobile app. 

However, critics like industry body Internet and Mobile Association of India (IAMAI) have flagged ambiguities in the Act and raised concerns over challenges posed by the new rules to tech startups and small businesses.