Personal data processing of Indian residents will soon have to comply with a new law known as Digital Personal Data Protection Act, 2023 (DPDP Act) which the President gave assent yesterday. The government is yet to notify the effective date for the enactment.

Unlike European Union and other developed economies, India does not have a specific law on data protection till date. Under the extant requirements, the use of personal data is governed under the Information Technology (IT) Act, 2000 and the rules made thereunder.

Gaming companies are among the largest collectors of data including identifiable information about players and others, which gaming companies in turn process in the context of their business activities. The data collected include e-mail addresses, sex/gender, device ID, age and – depending on whether in-game transactions are undertaken – card and other payment details. The real money gaming entities also collect tax information like PAN to process payments. Under the new law, consent given by minors (aged below 18 years) in relation to online games is only valid if a parental consent is obtained.

It is now time for the gaming companies to analyse the extent and nature of data held, the nature of consent that was taken at the time of its collection under the extant requirements.

Players often create accounts on gaming portals but don’t regularly use them. Gaming companies should now ensure the data subject to whom this data pertains to is reachable to enable them to exercise their rights as a data principal under DPDP Act.

The DPDP Act will need the gaming companies to build and implement new tools and functionalities, revamp existing  policies, implement new processes and procedures. In the event of a breach, entities will be subjected to heavy fines.

While so, the much talked GST rate hike to 28% is also expected to come into effect from 1 October. The DPDP Act will take 6-8 months to be implemented according to news reports.

Both the laws significantly impacting the real money gaming companies are expected to be implemented months apart making it a crucial time for the destiny of the sunrise sector in the country.