Asked about the potential shortening of compliance timelines for big tech under the data protection regime, Krishnan said the government is consulting industry stakeholders to assess their preparedness.
He added that since the issue is complex and affects several layers of digital ecosystem, the government’s priority is to avoid any disruption.
“On data protection board, we’ve started the process of putting in place the way to identify members and call for their nomination to put them in the positions and posts which the board would need…we are working on that right now, because we have to get it approved,” Krishnan told PTI in an interview.
Government is ready with the software required for a completely online office for the Data Protection Board.
“So work is going on,” the IT secretary said.
On whether the large companies have opposed shortening of compliance timelines, during their discussions with the IT Ministry, Krishnan said they hadn’t indicated their discomfort with any particular aspect.
“We’ve asked them to tell us when they will be ready and look at specific aspects….because please understand it’s complex,” he said.
The DPDP Act – that defines how entities should collect and process users’ data – envisages establishment of Data Protection Board of India, tasked with monitoring compliance, inquiring into breaches, and imposing penalties, and directing remedial or mitigation measures in case of data breach.
The board functions as an independent body and is set to play a key role in enforcing the rights granted under the Act and maintaining trust in the system.
According to the recently-notified DPDP Rules, the central government will set up a search-cum-selection committee, headed by the Cabinet Secretary, with the Law Secretary, the IT Secretary and two domain experts as members, to recommend names for appointment as chairperson of the data protection Board.
Another search-cum-selection panel will be set up, chaired by the IT secretary, and comprising Law Secretary and two domain experts, to recommend names for appointment as board members.
“The central government shall, after considering the suitability of individuals recommended by the search-cum-selection committee, appoint the Chairperson or other Member, as the case may be,” the DPDP rules say.
Data Protection Board to be up and running “in the coming months”, Krishnan said but declined to mention a specific timeline.
The Digital Personal Data Protection Act aims to provide a framework for the processing of digital personal data in a manner that recognises both the rights of the individuals to protect their personal data and the need to process such personal data for lawful purposes.
It seeks to protect digital personal data by outlining the obligations of Data Fiduciaries (persons, companies and government entities who process data) for data processing (collection, storage or any other operation on personal data); the rights and duties of Data Principals (person to whom the data relates to); and penalties for breach of rights, duties and obligations.
The Act places clear responsibilities on Data Fiduciaries to keep personal data safe and to stay accountable for its use. It also gives Data Principals the right to know how their data is handled.
The DPDP Act imposes stringent financial penalties for non-compliance; the highest penalty up to Rs 250 crore applies to failure of a Data Fiduciary to maintain reasonable security safeguards.
Not notifying the Board or affected individuals of a personal data breach as well as violations of obligations relating to children can each result in penalties of up to Rs 200 crore. Any other violation of the Act or Rules by a Data Fiduciary may attract penalties up to Rs 50 crore.
