Rollout of Data Rules set for mid-2025: IT Minister

What can we expect in the coming months with the DPDP rules? The consultation period is currently slated to end in February. Will you be moving for an immediate notification and then the implementation timeline starts, or do you foresee another round of consultations with another draft? 

The consultations so far have been very extensive and the feedback that we are getting is that people are by and large okay with the provisions, because most of the provisions have been made in consultation with all these stakeholders. So I don’t see too many amendments coming in the final notification — some tweaks here and there might happen, but not more than that. 

Parallelly, we have also worked on the entire digital implementation framework, so the Data Protection Board of India’s portal is ready, the workflows, how they will happen in a totally digital way…right now we are getting that tested for robustness, service and security. 

We would like to notify it as soon as we can, and of course we’ll give a good transition period to the industry to move to a new regime. So I think we should see the implementation of this Act starting somewhere in the middle of this year.

You mentioned a two year implementation timeline. Can you talk us through the justification for this? 

There will be different transition periods for different types of data fiduciaries. Different parts of the industry are at different levels of preparedness. Most of the large organizations are already prepared, but some people want some time for getting the consent manager framework in place. Some people want to understand the age verification process in a greater detail, so those are the items on which people are seeking some more time.

Otherwise, on reasonable safeguards for preventing breaches, to do all those things, most of the industry is prepared already, so we’ll take a nuanced approach once we get the formal suggestions or recommendations from the industry, then we’ll move to the final round. 24 months is the outer limit.

The rules outline standards that government organizations must adhere to. So in the event that they are in breach of these standards, will they also be liable to the same penalties and consequences?

 In this country, we have a system where the law stands the same for everybody. The law is supreme.  

Since 2023, there has been a concern that the institutional design of the Data Protection Board of India, and how it should be an independent body as opposed to under administrative control of the IT Ministry.

The law has been drafted in a way to ensure the functioning and autonomy of the board. What will be a big challenge — because this is a totally new evolving field — getting the right people who understand law, digital technology, financial implications, societal implications, all those things.

One thing we are doing is creating a reasonably high level of awareness programs across the industry, across government organisations, across common citizens, so that people know what their rights are, people know what their obligations are. 

In my opinion, obligations are as important as rights, sometimes more important, because once you fulfill your duty, then the other person’s rights are automatically enforced. 

We are also trying to engage people who are already highly knowledgeable about these topics in greater detail so that they understand the nuances of the law. 

 In this consultation process, the Ministry has stated not just in this rules, but also in the draft version of the preceding act that inputs from stakeholders will be held in a fiduciary capacity. Why is this particular route of consultations being used? The Telecom Regulatory Authority of India, for instance, has two rounds of consultations where everyone’s responses are published and there is an opportunity for stakeholders to address each other’s point of view. 

You cannot compare TRAI’s consultation process with a lawmaking consultation. Lawmaking is a sovereign act enabled by the Constitution. Laws are made in a very structured manner. TRAI consultations are regulations for the industry. I don’t think there’s any comparison. 

The Rules leave the door open to restricting data transfers of Indians to foreign governments. Do you share the concern that this may conflict with U.S. law that requires American firms to provide foreign nationals’ data, or is that the intention in the first place? 

The laws passed by the Parliament of India will be applicable to every entity, from every geography. They will have to implement and follow the law passed by the Parliament of India. As and when they are providing any service or doing any economic activity in the country, the laws of the Parliament of India have to be followed by everybody who’s doing business in the country. 

Recently, Meta announced that they are moving away from professional fact checkers to community-led fact checking. The IT Rules had provisions on fact checking bodies for general news and news on the government. 

This whole point proves that the stand that we had taken was the right one, that the owner or the generator of the information, or the person who is well-placed to fact check in a particular sector on a particular subject is the right person to do so. 

For example, for everything related to the central government, the facts have to be checked by the central government; for things related to, let’s say, State governments, the State government should be doing the fact checking. For things related to a particular private industry, that industry is the right one to do so. 

This stand is now being legally challenged, so how are you going to proceed? 

Let the courts decide. This is a very logical way to proceed, and there is no bias in this entire thought process. 

On January 6, the subcommittee on AI Governance under the IndiaAI Mission’s Advisory Group led by the Principal Scientific Advisor put out a draft report saying that we need a “whole of government approach” for creating a framework for Artificial Intelligence.

The subject of AI has three major dimensions. The first dimension is the power that it brings for solving our very complex problems, which we must harness. Second, the potential harms it can cause; we must protect our society from those harms. And third, there is a large technology component of it which will create new opportunities for our companies, our youths and startups, that we should not block.  

So that’s why our Principal Scientific Advisor has taken this initiative under the honourable Prime Minister’s guidance, to create a holistic plan for the country. This complements the IndiaAI Mission, and one of the seven pillars of the mission is to create a good regulatory framework which develops trust, balances innovation and regulation, and creates opportunities for the youth. Once we get inputs from the industry, we’ll publish the final policy. 

 This is a common thread — balancing innovation and regulation — that you have cited in your approach to data protection, AI and other issues. But do you think that innovation and strict rules are necessarily in conflict when it comes to issues like this?

No, they’re not. The reason I say this is because some geographies have actually put so much emphasis on the regulation part that the innovation potential there has reduced; and there are some geographies which do not want any regulation, they simply want 100% innovation. That is the context. We are actually trying to place ourselves somewhere between the two. We want a balance of both. And I think the world is noticing; in informal meetings, people are saying that this is the right template which the world should follow. 

There is an impact [of big tech and social media] on institutions which have been built over centuries, and most societies are today worried that the institutions are weakened because of the misinformation and the fake news.  

So everywhere the society is looking for the right balance between absolute free speech and the right mix of regulation.

The Rules do not outright ban social media for children, like some countries are doing, but require authentication of parental consent. 

Here again, we have taken a very nuanced approach and our approach is that these are things which must evolve, and the society must create a consensus around these subjects. So that’s why in the Parliament also, we have very clearly stated that we would like to create a consensus around these matters. Society and the law have to walk in tandem. 

We want to work in partnership with society.

There are studies on the impact of social media on children, so is this a subject that the government is seized on? 

Of course.

There are also larger policy shifts that are underway over the last two–three years, and the Digital India Act has been one of them. Are we still moving in the direction of overhauling the IT Act and replacing it with a DIA? 

We have to overhaul the entire digital framework. We began with the two horizontal laws, the Telecommunication Act, 2023 and the DPDP Act, 2023, which cut across all the sectors and have an impact on all sectors. There will be certain verticals which are specific to sectors, and we are working on this whole comprehensive framework. 

On electronics manufacturing, we have seen progress on semiconductor packaging plants and IT hardware. What can we expect in component manufacturing? 

Both in the component ecosystem as well as in the semiconductor materials ecosystem and equipment ecosystem, we are seeing very high levels of interest from a variety of stakeholders in the entire value chain. 

So we are working on a program for promoting and incentivising component manufacturing in our country. We are also working on getting the semiconductor ecosystem players into the country and there’s very good genuine interest. 

The product validation center of Applied Materials that is now functional in Bengaluru; there is one more centre which is likely to open up very soon in Karnataka, which will be much more expanded, which is focusing on designing equipment in India.

Microsoft announced that it would invest $3 billion in India, and there were deals announced with the IT Ministry and private firms. What role does the private sector have in the government and India’s overall AI ambitions, whether it is global tech giants like Microsoft or India’s own domestic private sector? 

 All players in the industry have a big role to play in a growth story. The IT industry, whether it is Indian players or global firms, has created many new opportunities. We see a very clear trend that the competitiveness of our talent is very well accepted, and so is the certainty of our policies. The growth of the domestic market is also getting recognition. 

So now the global IT industry and the global industry, which was earlier looking at India mostly from a cost and talent arbitrage, are also looking at India as a major potential demand center. So that’s a big fundamental change in the last few years that means the investments will now accelerate in the country in sector after sector.  

We are also looking at major products; we are preparing a list of about 20–25 chipsets which have a large volume, and we would like to develop Indian chipsets on that. In the coming years, now that we have come to a good level, the world believes that yes, these guys can do semiconductors. So now we want to take that next step with these products. 

 Globally the tech world is moving in two geopolitical directions. How are we positioned in this? 

Due to many geopolitical and demographic reasons, new opportunities are opening up in India. The growth of the Indian market is also bringing new opportunities. This means that India also becomes a major embedded part of the global value chains (GVCs). 

Once you are part of the GVCs, then the multiplier effect on the economy, on production and on product development, on sourcing, that increases manifold. For a single mobile phone, there are about 38 factories which are producing the various components and what is visible is the final product. 

Even going behind that, there are capital goods manufacturers. One of the companies has designed a large part of essential assembly equipment, which is very complex and precise. They have designed and started manufacturing this at a fraction of the cost at which they were importing this equipment earlier. There has also been progress in the manufacturing of servers and laptops; there will soon be a laptop production facility in Chennai.