Govt Aims to Compress DPDP Act Compliance Timelines: Ashwini Vaishnaw
The government is actively working with major companies to “significantly compress the compliance timelines” for India’s new Digital Personal Data Protection (DPDP) Act, announced Electronics and IT Minister Ashwini Vaishnaw.
He stated that once the Data Protection Board is established and the prepared digital framework is rolled out, further rule amendments will be introduced to shorten these deadlines.
“The first set of rules that we have published provides a reasonable time frame for compliance, based on what industry had requested and what our priorities were. We are also in touch with industry to further compress the compliance timelines, because we have given them the same argument: they already follow compliance frameworks in other geographies—why not replicate them here? They are quite positive about this,” said the minister.
DPDP Act Implementation and Key Obligations
The DPDP Act, India’s first comprehensive data protection law, will be implemented in three stages. Its main provisions become effective after eighteen months, covering:
- Data collection, use, and consent requirements
- Individual rights and children’s data protections
- Cross-border data transfers and data-breach responsibilities
- Full obligations for Significant Data Fiduciaries
Large companies like Google, Meta, and other entities handling sensitive data are classified as Significant Data Fiduciaries. They face stricter norms, including:
- Annual Data Protection Impact Assessments
- Yearly audits
- Ensuring automated decision-making systems are safe and fair
DPDP Act Does Not Dilute RTI: Minister
Addressing concerns about the Right to Information (RTI) Act, Vaishnaw clarified that the DPDP Act does not dilute it. He cited Section 8(2)(a) of the RTI Act, which mandates that information required for public interest must continue to be disclosed.
“That provision remains unchanged—there is no amendment. So the framework is not diluted in any way. In fact, citizens gain more rights to information through the DPDP Act, which gives them the right to know what personal information has been collected by tech companies and data fiduciaries. The right to information is actually enhanced by the DPDP Act and the rules,” Vaishnaw said.
