Centre Directs Ministries, States To Prepare Time-Bound Plans For DPDP Act Compliance

New Delhi, Aug 29 (KNN) The Centre has begun a formal exercise to ensure compliance with the Digital Personal Data Protection (DPDP) Act, 2023 across government, with Cabinet Secretary T V Somanathan directing central ministries, state governments and Union Territory administrations to prepare time-bound implementation plans.

In an August 20 letter to Union government secretaries and state and UT chief secretaries, Somanathan asked them to accord high priority to implementing the law and designate senior officials to oversee the process. 

Each ministry, department and state has also been asked to nominate a nodal officer to coordinate with the Ministry of Electronics and Information Technology (MeitY), the nodal ministry for the Act.

Review of Data Practices

Government entities functioning as ‘data fiduciaries’ under the Act have been asked to systematically review their digital systems and data-processing practices.

The exercise will include identifying personal-data processing activities, preparing data inventories, reviewing privacy notices, consent mechanisms where applicable and grievance-redressal systems. 

Departments will also have to strengthen technical and organisational safeguards and review contracts with third-party vendors and data processors.

Privacy by Design

The government has emphasised incorporating privacy considerations into digital services from the design stage rather than treating them solely as a post-development compliance requirement.

Ministries and states have been asked to adopt privacy-by-design principles while developing, upgrading and operating digital government services. Legacy systems are to be reviewed and upgraded through a phased, risk-based approach.

Senior-Level Oversight

Secretaries and chief secretaries will be responsible for periodically reviewing implementation progress. The government has also called for appropriate governance structures, institutional processes and capacity-building programmes for officials handling personal data.

The move is significant as government agencies are among the largest processors of citizens’ personal information through systems covering welfare delivery, taxation, healthcare, identity and other public services.

MeitY to Provide Implementation Support

MeitY has initiated guidance material, awareness programmes, capacity-building initiatives and stakeholder consultations to support implementation of the Act.

Somanathan has sought brief status reports from ministries, departments and states on their implementation efforts. The reports are intended to help identify common challenges and address issues requiring guidance or coordinated support.

The exercise is expected to provide an early test of how the DPDP Act’s privacy and data-protection requirements are implemented across the government’s expanding digital infrastructure.

(KNN Bureau)