Following January meeting, MeitY seeks feedback on DPDP rule timelines by Feb 4

The Ministry of Electronics and Information Technology (MeitY) has invited social media platforms and digital companies to share their views on accelerating the implementation of key provisions under India’s Digital Personal Data Protection (DPDP) Act and Rules.

Among the proposals under consideration is a reduction in the compliance timeline for data fiduciaries from the current 18 months to 12 months.

In an email circulated to platforms following a meeting held on January 22, MeitY outlined three proposed changes and sought industry feedback by February 4. The communication stated that the time period for compliance obligations applicable to data fiduciaries under the DPDP Act and Rules is proposed to be shortened to 12 months.

The ministry also proposed the immediate commencement of Rules 15 and 23 of the DPDP Rules, along with bringing Rule 8(3) into force within three months.

Rule 15 specifies the conditions under which personal data may be processed in a de-anonymized form for research, archiving, and statistical purposes, while Rule 23 covers miscellaneous procedural provisions. Rule 8(3), which MeitY has suggested operationalizing within three months, allows data fiduciaries to retain personal data beyond its original purpose where required by law, court orders, or for investigations and legal proceedings, subject to prescribed safeguards.

During the January 22 meeting, officials presented a set of “suggested recommendations” aimed at compressing implementation timelines. The presentation proposed immediate enforcement of certain rules related to cross-border data transfers and the classification of personal data, citing the limited need for significant infrastructural changes by companies.

It further recommended reducing the compliance timeline for Rule 13—governing obligations of Significant Data Fiduciaries—to 12 months. This includes provisions related to processing specified categories of personal data within India, based on recommendations from a government-appointed committee.

Another proposal discussed was the immediate operationalization of Section 17(2) of the DPDP Act, which would require the notification of authorized agencies and the implementation of the exemption framework for specified data processing activities.