For the first time, the rules for the Digital Personal Data Protection Act categorise various types of data fiduciaries and stipulate that entities like e-commerce platforms, online gaming services, and social media networks must delete user data three years after it is no longer needed.
These requirements are outlined in Section 8 of the draft rules, which mandate that data fiduciaries must erase personal data when it is no longer necessary for its intended purpose. The Third Schedule of the draft rules specifies the data retention timelines for different data fiduciaries, including social media platforms, online gaming platforms, and e-commerce entities.
Such platforms are required to notify users at least 48 hours before data deletion, providing them the opportunity to log in or initiate contact to retain their information. User accounts encompass profiles, email addresses, or phone numbers used for accessing services.
The draft rules, which were made available on January 3 for public consultation, will be open for feedback until February 18.
The draft further defines e-commerce platforms as entities with no fewer than 20 million registered users in India, online gaming intermediaries as those with 5 million or more users, and social media intermediaries as those with 20 million or more users in India.
Additionally, these data fiduciaries must allow users to access their accounts and provide access to any virtual tokens that can be exchanged for money, goods, or services.
The schedule also defines an e-commerce entity as “any person who owns, operates, or manages a digital facility or platform for e-commerce as defined in the Consumer Protection Act, 2019 (35 of 2019), but does not include a seller offering her goods or services for sale on a marketplace e-commerce entity as defined in the said Act.”
The definition of an online gaming intermediary is “any intermediary who enables the users of its computer resource to access one or more online games”.
Finally, the draft rules describe a social media intermediary as “an intermediary as defined in the Information Technology Act, 2000 (21 of 2000) who primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify, or access information using her services.” Business Standard