Draft DPDP rules are here, but are we ready? Experts say not yet

Have you ever been at a café or restaurant counter where the staff asked for your phone number to place an order, or on a website where you had to enter your email or phone number to complete a transaction? You may not have known, but you had the right to decline such requests.

While digitalisation has made life easier in various ways, it has also introduced significant risks, most notably the misuse of personal information without proper consent. 

Recognising this challenge, the Ministry of Electronics and Information Technology (MeitY) has proposed draft regulations under the Digital Personal Data Protection (DPDP) Act.

Also Read: DPDP Act: What will it take for marketers to master the data game

These proposed regulations aim to establish robust data collection frameworks, enforce consent management protocols, and implement safeguards for children’s personal information, among other critical provisions.

The government estimates that fully implementing the DPDP Act will take around two years. While several other laws, including the Information Technology Act, 2000 and Consumer Protection Act, 2019 already exist to safeguard personal data, many consumers remain unaware of their rights.

This lack of awareness is often caused by complex legal jargon, insufficient education on the subject, and confusion about how to apply these laws or where to file complaints.

There is a significant gap between enacting a law and ensuring its effective implementation. To bridge this gap, it is crucial to raise awareness about the data rights of consumers. 

The government must undertake proactive and large-scale education campaigns to inform citizens about their rights and empower them to exercise these protections effectively.

According to Manisha Kapoor, CEO and secretary general of ASCI, the new DPDP rules focus on transparency by mandating explicit opt-ins, enabling seamless consent withdrawal, and ensuring data erasure after three years.

She also emphasises that concerted efforts from the government, civil society, and other stakeholders are essential to improving consumer awareness of their rights under these regulations.

Chandramouli Nilakantan, CEO of TRA Research, a market insights and brand analytics company, calls on the government to launch a public education campaign to raise awareness about data rights and the importance of consent.

He further suggests incorporating data privacy education into school curricula and holding workshops for various demographics. 

"Collaborating with non-profit organisations can ensure that the rules are effectively communicated to diverse groups. By emphasising children's data protection and its prohibition in advertising, these efforts will highlight the unique safeguards embedded in the new framework," he adds.

Lloyd Mathias, a business strategist and angel investor, emphasises that the current focus is on raising awareness, particularly regarding individuals' rights, as awareness is critical.

He points out that people often unknowingly give consent due to the fine print. Under the proposed changes, however, specific consent will be required for each app. 

"Consent will now be app-specific and purpose-specific, meaning users will need to provide separate consent for each usage," he explains.

Mathias notes that this is a significant step, as building awareness is critical. He stresses that individuals must become more conscious of the data they share, and that the responsibility for data awareness ultimately lies with the users themselves.

Kapoor adds that government bodies have a crucial role in educating citizens about their rights under the new data protection rules. 

In addition to launching targeted consumer education campaigns, the government must ensure that brands comply with these regulations, offering consumers the opportunity to directly engage with and understand their rights.

Experts emphasise the urgency of educating consumers to ensure that the provisions of the act are effective. According to them, awareness campaigns, coupled with stringent penalties for violations, aim to create a more secure and transparent digital ecosystem for users.