New Delhi: From promptly alerting users and Data Protection Board about data breaches, to retaining all traffic data and logs for a minimum of one year, and from providing users with a 48-hour heads-up before personal data erasure, to requiring large companies to conduct impact assessments and audits every 12 months, the DPDP Rules set clear and distinct timelines that firms must rigorously follow.

E-commerce entities, online gaming companies, and social media platforms will be required to erase personal data after three years of user inactivity or dormancy, except in two cases specified.

The DPDP rules also require 'consent manager' to maintain records of consents for at least seven years or longer where necessary.

The freshly minted DPDP Rule says that inquiry by the Data Protection B

See Full Page