During a IT Ministry organised consultation with the tech industry Tuesday on the recently released draft data protection rules, a few concerns stood out: apprehensions over data localisation, consent verification and behavioural tracking of children, and worries over cross-border data flows to foreign jurisdictions. The consultation that went on for over two hours saw representation from tech companies such as Meta, Google, Microsoft, Snap and a myriad of industry lobby groups and consultancies which represent them. It was chaired by IT Minister Ashwini Vaishnaw, and IT Secretary S Krishnan. At the meeting, the government assured the industry of holding extensive consultations with the industry, and giving ample time to submit comments. Some industry bodies are learnt to have expressed reservations around potential data localisation requirements that could be imposed on significant data fiduciaries under the draft Digital Personal Data Protection Rules, 2025. Data localisation has been a bugbear for the tech industry for several years now, and the data protection rules envision the creation of a government appointed committee which would recommend the classes of data and traffic patterns pertaining to them which would not be able to be exported from India. This requirement has only been proposed for significant data fiduciaries, which will be determined on the basis of the volume and sensitivity of personal data they process, and the risks they might have on sovereignty and integrity of India, electoral democracy, security, and public order. All major tech companies including Meta, Google, Apple, Microsoft, and Amazon are expected to be classified as significant data fiduciaries. However, the government has clarified that the committee has been proposed to create a central body which works with other ministries and sectoral regulators to effectively implement local storage of data without causing any disruptions to the industry. “The government-appointed committee will act as a central body, which will collate requests from all other sectoral regulators and ministries, which see the need for certain data to be localised. Based on that, the committee will first hold industry consultations and then come up with its recommendations,” Vaishnaw had earlier told this paper. Some participants also raised concerns around obtaining verifiable parental consent for allowing children – those below the age of 18 – from accessing online services, and how the digital architecture around it could be reliably operationalised. A few participants highlighted that bigger companies, with access to information on more people, might have a competitive advantage in implementing this provision, with smaller firms facing a bigger challenge. Concerns were also raised around children potentially falsifying their age while signing up for platforms, and limiting content for children who may not have tech literate parents.
