Data Protection: Companies will be given time to adjust, says MoS Rajeev Chandrasekhar

Companies will be given time to move into a "new regime" under the Digital Personal Data Protection (DPDP) Act that has been notified, Union Minister of State for Electronics & IT Rajeev Chandrasekhar said on Saturday.

The minister was speaking at a Sansad Dhvani event hosted by Bangalore South MP Tejasvi Surya.

"We'll have a transition period since we're moving to a new regime. We'll give industries and companies time. Everyone has to adjust. The big tech platforms will be given shorter time while startups will be given more time," Chandrasekhar said.

"On day zero, when the law comes into effect, all platforms that already have your data should come to you and seek your consent," the minister said.

Passed by Parliament earlier this week, the DPDP Bill has received President Droupadi Murmu's assent.

"The era of misuse and exploitation of personal data, and platforms believing that Indian citizens don't have rights over personal data comes to an end," Chandrasekhar said. "Platforms can use your data for all kinds of things, including to cause harm...intended or unintended. This bad behaviour...this misuse of personal data is an open secret," he said.

"No platform can use your personal data without you agreeing. Platforms have to ask you that question in a meaningful, informed manner," Chandrasekhar said, adding that selling data will also be violation of the law.

The DPDP Act carries a penalty of up to Rs 250 crore on entities found misusing or failing to protect digital data of individuals.

"Whenever there's a dispute, all that the citizen has to do is go to a website and send details of the breach to the Data Protection Board. An investigation happens and penalty as high as Rs 250 crore per breach is levied," Chandrasekhar said.

Chandrasekhar explained that platforms should seek only that data that is required to deliver a service, use it for the consented purpose and store it only for a period necessary to provide the service.

Chandrasekhar clarified that the government does not intend on making money by hoping platforms breach data rights. "The penalties are not in anyway for the government to make money. They are there so that platforms understand that the government takes personal data very seriously," he said.