DPDP rules: E-commerce, gaming platforms to delete personal user data
What's the story
The draft rules for the Digital Personal Data Protection (DPDP) Act have proposed that e-commerce, online gaming, and social media platforms must erase personal user data three years after it is no longer required.
Part of Section 8 of the draft rules, this provision mandates data erasure when it is no longer needed for its specified purpose.
The Third Schedule of these draft rules outlines specific timelines for data erasure by different types of data fiduciaries.
User rights
User notification and account access under new draft rules
The draft rules also mandate platforms to inform users at least 48 hours before deleting their data. This gives users a chance to log in or reach out to the platform to save their information.
A user account includes profiles, email addresses, or phone numbers associated with the user Principal.
These platforms will also have to allow user access to their accounts and any virtual tokens used for transactions.
Consultation period
Public consultation and platform classification
The draft rules were released on January 3 and are open for public consultation till February 18, 2025.
They define an e-commerce platform as one having at least two crore registered users in India.
An online gaming intermediary is defined as having 50 lakh or more users in the country, while a social media intermediary is identified as having two crore or more users in India.
Platform definitions
Definitions of e-commerce, gaming and social media platforms
The draft rules define an e-commerce entity as any person owning, operating, or managing a digital facility or platform for e-commerce under the Consumer Protection Act, 2019.
This definition excludes sellers offering goods on a marketplace e-commerce entity.
An online gaming intermediary is defined as enabling access to one or more online games.
A social media intermediary is defined under the Information Technology Act, 2000 as enabling online interaction between users and allowing content creation and sharing.