Introduction

The Union government is considering accelerating compliance timelines for major technology companies under India’s data protection framework. The proposed move would require global Big Tech firms to align with key obligations of the Digital Personal Data Protection Act, 2023 within 12 months, instead of the previously indicated 18 months, signaling a tougher and more differentiated regulatory approach.

Background / Context

According to sources cited by The Indian Express, the Ministry of Electronics and Information Technology (MeitY) is exploring amendments to the data protection rules to create separate compliance regimes for large technology companies and smaller startups. The rationale is that global platforms already operate under stringent privacy frameworks such as Europe’s General Data Protection Regulation (GDPR) and therefore possess greater institutional and technical capacity to comply faster.

Who Will Be Affected

The shortened timeline is expected to primarily impact companies likely to be designated as Significant Data Fiduciaries (SDFs). This category is determined by factors such as volume and sensitivity of personal data processed, and potential risks to national sovereignty, electoral democracy, security, and public order. Firms expected to fall under this classification include Meta, Google, Apple, Microsoft, and Amazon.

Key Compliance Obligations

If fast-tracked, SDF-specific provisions would become operational within 12 months and include:

• Annual Data Protection Impact Assessments
• Independent verification that algorithms and technical systems handling personal data do not violate user rights
• Restrictions on cross-border transfer of specified categories of personal and traffic data
• Potential mandatory data localisation requirements for certain data classes

A government committee tasked with defining which data must be localised within India is also expected to be constituted sooner than initially planned.

Children’s Data and Breach Reporting

Under the notified rules, companies must implement mechanisms to obtain verifiable parental consent before processing children’s personal data. The government has deliberately avoided prescribing a uniform technical solution, leaving implementation choices to platforms after industry feedback highlighted operational challenges.

In the event of a data breach, data fiduciaries are required to notify affected users without delay, detailing the nature, scope, timing, likely consequences, and mitigation measures. Failure to maintain adequate safeguards can attract penalties of up to Rs 250 crore.

Policy Rationale

Union IT Minister Ashwini Vaishnaw had earlier indicated the government’s intent to compress compliance timelines for large firms, noting their prior experience with global privacy laws. The broader objective is to ease regulatory pressure on startups while holding large platforms to higher and faster standards.

Ongoing Criticism and Legal Concerns

Despite progress toward operationalising a long-pending privacy framework, the Act has faced criticism for granting broad exemptions to the government and its agencies on grounds such as national security and public order. It has also been scrutinised for potentially weakening transparency under the RTI regime. Notably, even NITI Aayog had flagged concerns regarding possible dilution of the RTI Act.

The data protection rules were notified last year, nearly eight years after the Supreme Court of India recognised privacy as a fundamental right.

Outlook

If the proposed amendments move forward, Big Tech companies may push back against the compressed timeline, particularly around data localisation and algorithmic audits. However, the move underscores India’s intent to assert stronger digital sovereignty while accelerating enforcement of its privacy regime.

Sources

• The Indian Express
  Original report on MeitY considering shortening the compliance timeline for Big Tech under the DPDP Act.
  https://indianexpress.com/section/technology/
• Ministry of Electronics and Information Technology (MeitY), Government of India
  Official updates, notifications, and draft rules related to India’s data protection framework.
  https://www.meity.gov.in/
• Digital Personal Data Protection Act, 2023 – Government of India
  Full text of the Act outlining obligations, penalties, significant data fiduciaries, and breach reporting.
  https://www.meity.gov.in/data-protection-framework
• Press Statements and Interviews – Ashwini Vaishnaw (Union IT Minister)
  Public comments on compressing compliance timelines for large technology companies.
  https://pib.gov.in/
• Supreme Court of India – Right to Privacy Judgment (Puttaswamy Case)
  Landmark ruling recognising privacy as a fundamental right.
  https://main.sci.gov.in/
• NITI Aayog
  Policy discussions and concerns regarding data governance and RTI implications.
  https://www.niti.gov.in/