India greenlights Digital Data Protection law imposing new compliance requirements for gaming firms

The Indian Parliament has finally approved the Digital Personal Data Protection (DPDP) Bill, 2023 (“Bill”) ushering a new era in the story of Digital India. A draft of the bill was introduced in November 2022 and is now set to become a law after receiving the approval from the President of India.

First introduced in 2019, the Digital Personal Data Protection aims to protect the personal data of Indian citizens. It specifies how data should be kept, processed, and safeguarded. The bill establishes data fiduciary requirements for processing digital personal data and the practises they must take to avoid data breaches. It also outlines the data principal’s consent to provide such information.

Similar to GDPR, personal data may be processed by entities that define the methods and purposes of processing, known as Data Fiduciaries, and entities such as contractors and service providers, known as Data Processors, may process personal data on behalf of such Data Fiduciaries. For gaming sector, the players will be the data principals, while gaming firms that collect data will be the data fiduciaries.

The law establishes rules, many of which like consent, purpose limitation, and data minimization, have been developed through the consultation process. The provisions of the law will be applicable to any data concerning an identifiable individual in digital form or personal data that may be digitised later. The law will be applicable on all gaming companies using digital form to collect personal data.

The Bill authorises a Data Fiduciary to process children’s personal data only with parental consent. ESports organisers that have participants under the age of 18 will need to seek parental approval.

The concept of data minimisation will be applied to all digital data collection, and entities will only be able to acquire as much personal data as is required by them to serve the declared purpose.

Ashwini Vaishnaw, Minister of Electronics and Information Technology, stated that the bill will be implemented within the next six to ten months.  Keep check OPN for more such updates!