Your Data Under Lock & Key! India's New Privacy Act Forces Companies to Delete Inactive Accounts!

Author

Akshat Lakshkar | Whalesbook News Team

Detailed Coverage:

The Indian government has officially notified detailed regulations for the Digital Personal Data Protection (DPDP) Act, marking a significant step in the country's digital privacy landscape. This new framework mandates stringent data-retention policies for major online platforms. E-commerce, social media, and online gaming companies will now be required to delete the personal data of any user who has remained inactive for three consecutive years. Before data deletion, these platforms must provide users with a 48-hour notice. The rules specifically target online gaming companies with over 50 lakh users and social media and e-commerce platforms with more than two crore registered users in India.

Furthermore, platforms identified as 'significant data fiduciaries' – those with over 50 lakh users – face heightened compliance obligations. These include conducting annual audits and Data Protection Impact Assessments to ensure their systems, algorithms, and procedures do not compromise user rights. They must also annually verify the safety and compliance of their technical measures. While the DPDP Act permits cross-border data transfers, the government emphasizes that these must adhere to regularly updated rules, particularly when data is sent to foreign states or entities controlled by foreign governments. These comprehensive measures aim to bolster data governance and enhance user protection across India's rapidly expanding digital ecosystem.

**Impact**: This news will have a direct impact on Indian stock market companies operating in the digital space, potentially increasing operational and compliance costs. Companies will need to invest in robust data management systems and processes. User trust and data security could become significant competitive differentiators. The regulations may also influence investment strategies in the tech and e-commerce sectors. Rating: 7/10.

**Difficult Terms**: * **Data-retention rules**: Regulations that specify how long companies must keep customer data. * **Social media intermediaries**: Platforms that facilitate communication and content sharing for users, like Facebook or Twitter. * **Significant data fiduciaries**: Companies that handle a large volume of personal data and are therefore subject to stricter regulatory requirements. * **Data Protection Impact Assessment (DPIA)**: A process to identify and minimize data protection risks associated with a project or system. * **Cross-border transfers**: Moving personal data from one country to another.