India’s draft rules for protecting privacy have adopted selective dynamic controls that should make them easier to implement. Sectoral requirements for data localisation are a step forward from a blanket clause for all types of data. Critical personal data, such as those dealing with health or finance, faces lower opposition over export control while less-sensitive information is relatively unrestricted, serving the needs of digital commerce. India’s approach to data flow is consistent with its conservative regulatory approach that has stood the test of time. A radical departure wasn’t to be expected over privacy protection. The same principle applies to categorisation of data fiduciaries with differentiated treatment based on volume and sensitivity of the information they process.Phased implementation of the rules should provide enough runway for data collecting entities to implement safeguard provisions. Implementing data security measures and intimating breaches with consequences and mitigation efforts require process upgrades for which the draft rules have made adequate provision. Industry is expected to move faster on this than government agencies, which have to follow safeguards in how data of citizens can be processed. The data protection law came in for public scrutiny over carve-outs for GoI, and the rules are designed to put a framework in place for official data collection and processing.
Upfront declaration of data being collected, purpose of its processing and its end-use are basic privacy protection requirements the rules cover adequately. They go beyond to regulate consent management through intermediaries, thereby addressing needs of informed consumer interest. Specific rules on parental consent for minors could become a template for other jurisdictions grappling with the issue. The rules have benefited from intensive stakeholder engagement that led to the scrapping of a proposed law and an elaborately revised one replacing it. The new law has been awaiting rules, which are likely to go through with minor changes.
