Thursday , July 3 2025
Digital Personal Data Protection

India releases draft Digital Personal Data Protection Rules

On Friday, the Indian government released the draft Digital Personal Data Protection Rules, requiring social media and online platforms to obtain verifiable consent from parents before children can create accounts.

Parents must validate their identity and age using voluntary identity proof issued by a recognized legal entity or the government, according to the draft rules.

CYDES 2025 Reinforces Malaysia’s Vision of Secure and Trusted Digital Nation

The final day of the Cyber Defence & Security Exhibition and Conference (CYDES) 2025 concluded with high-impact engagements at the...
Read More
CYDES 2025 Reinforces Malaysia’s Vision of Secure and Trusted Digital Nation

Cisco alerts that Unified CM has hardcoded root SSH credentials

Cisco warns that a vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition...
Read More
Cisco alerts that Unified CM has hardcoded root SSH credentials

CYDES 2025
MCSS to implement 6 strategic goals with 7 objectives over 6 year: NACSA Chief

The second day of the Cyber Defence & Security Exhibition and Conference (CYDES) 2025 further cemented Malaysia’s position as a...
Read More
CYDES 2025  MCSS to implement 6 strategic goals with 7 objectives over 6 year: NACSA Chief

CYDES 2025
Malaysia placed cybersecurity heart of the regional agenda: DPM Ahmad Zahid

Malaysia's Deputy Prime Minister Datuk Seri Dr. Ahmad Zahid Hamidi said that Malaysia has placed cybersecurity at the heart of...
Read More
CYDES 2025  Malaysia placed cybersecurity heart of the regional agenda: DPM Ahmad Zahid

Amid Meta moves; OpenAI is largely shutting down next week: Wired

Mark Chen, the chief research officer at OpenAI, sent a forceful memo to staff on Saturday, promising to go head-to-head...
Read More
Amid Meta moves; OpenAI is largely shutting down next week: Wired

Canada orders Hikvision to close operations over national security

The Canadian government ordered Hikvision to stop all operations in the country due to national security concerns. Hikvision, based in...
Read More
Canada orders Hikvision to close operations over national security

First couple “Rosie” to conceive using AI tech “STAR” successfully

Doctors at Columbia University Fertility Center have reported what they are calling the first pregnancy using a new AI system,...
Read More
First couple “Rosie” to conceive using AI tech “STAR” successfully

Scattered Spider Actively Attacking Aviation and Transportation: FBI

Cybersecurity experts and federal authorities are warning that the Scattered Spider hackers are now targeting aviation and transportation, indicating a...
Read More
Scattered Spider Actively Attacking Aviation and Transportation: FBI

Russia’s restrictions on Cloudflare making websites inaccessible

Since June 9, 2025, Russian users connecting to Cloudflare services have faced throttling by ISPs. As the throttling is being...
Read More
Russia’s restrictions on Cloudflare making websites inaccessible

61 million Verizon records allegedly posted online for sale

A new report from SafetyDetectives reveals that hackers posted a massive 3.1GB dataset online, containing about 61 million records reportedly...
Read More
61 million Verizon records allegedly posted online for sale

Entities can only use personal data if individuals have consented through consent managers, who are responsible for managing consent records.

Digital platforms must verify that anyone claiming to be a child’s parent is an adult and can be identified for legal compliance when processing children’s data.

“A Data Fiduciary shall adopt appropriate technical and organizational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child,” the draft rule said.

The Union Ministry of Electronics and Information Technology plans to assign trained data experts across various central government ministries to improve data usage. E-commerce, social media, and gaming platforms will be considered data fiduciaries.

Data fiduciaries must retain data only for the duration of consent and delete it afterward, according to the draft rules. Draft rules have been released after 14 months since Parliament approved the Digital Data Protection Bill 2023.

“Draft of rules proposed to be made by the central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby,” the draft notification said.

The draft rules have mentioned the process of suspending or cancelling registration of consent manager in case of repeated violation, but there is no mention of penalties that were approved under the DPDP Act, 2023.

The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries.

IndusLaw Partner Shreya Suri said that there was an anticipation of introducing thresholds for data breach reporting, where minor breaches could have had fewer compliance obligations.

“However, the current draft treats all breaches uniformly, requiring the same level of reporting and notification to the Data Protection Board and affected data principals, without granting any discretion whatsoever to data fiduciaries. Additionally, while the rules outline certain considerations for reasonable security practices, the lack of detailed guidance leaves room for varied interpretations,” Suri said.

Draft rules are open for public consultation until February 18. They can be viewed on the MyGov website for comments. Final rules will be made afterward.

Mayuran Palanisamy, a Partner at Deloitte India, stated that the draft rules provide important guidance for businesses in India. They outline compliance requirements for Significant Data Fiduciaries, the registration and responsibilities of Consent Managers, the establishment and operation of the Data Protection Board, data breach notification procedures, and timelines for Data Fiduciaries to address grievances.

“We foresee that businesses will face some complex challenges in managing consent as it forms the heart of the law. Maintaining consent artefacts and offering the option to withdraw consent for specific purposes could necessitate changes at the design and architecture level of applications and platforms,” Palanisamy said.

Organizations must invest in technical infrastructure and processes to meet requirements. This includes improving data collection practices, implementing consent management systems, establishing clear data lifecycle protocols, and ensuring these practices are effectively applied.

Check Also

AI

First couple “Rosie” to conceive using AI tech “STAR” successfully

Doctors at Columbia University Fertility Center have reported what they are calling the first pregnancy …

Leave a Reply

Your email address will not be published. Required fields are marked *