Draft Digital Personal Data Protection Rules, 2025

Posted 22 Feb 2025

Updated 27 Feb 2025

6 min read

Why in the News?

Ministry of Electronics and Information Technology (MeitY) released draft Digital Personal Data Protection Rules, 2025 to facilitate implementation of Digital Personal Data Protection Act, 2023 (DPDP Act).

Brief Background of DPDP Act, 2023

Supreme Court's K S Puttaswamy judgment (2017) recognized right to privacy as a fundamental right under Article 21 and directed the government to establish a robust data protection regime.
In 2017, Justice B.N. Srikrishna Committee examined data protection issues. Based on its recommendations, Personal Data Protection Bill, 2019 was introduced which was later withdrawn.
MeitY released a draft of the DPDP Bill 2022 for public consultations, which later became the DPDP Act 2023.

An infographic titled

Digital Personal Data Protection Act, 2023

Primary objective of Act is to establish a comprehensive framework for Protection and Processing of Personal Data.
It protects digital personal data (means personal data in digital form) by providing for:
- The obligations of Data Fiduciaries (that is, persons, companies and government entities who process data) for data processing;
- The rights and duties of Data Principals (that is, the person to whom the data relates);
- Consent manager i.e., Person or entity that is officially registered with Data Protection Board of India (DPBI).
  - It provides transparent& interoperable platform to enable data principals to give, review, and withdraw their consent.
- Financial penalties for breach of rights, duties, and obligations.

Key Provisions of Digital Personal Data Protection Act, 2023

Specifications	Detail
Applicability	Processing of digital personal data within India where such data is collected: In digital form or In non-digital form and digitized subsequently. Processing of personal data outside India if it is for offering goods or services in India. Does not apply to: Personal data processed for any personal purpose. Personal data that is made or caused to be made publicly available by- Data Principal to whom such personal data relates; or any other person under legal obligation to make such personal data publicly available
Consent	Personal data may be processed only for a lawful purpose after obtaining the consent of the Data Principal (who shall have the right to withdraw consent at any time). Consent will not be required for 'legitimate uses' including the provision of benefits or services by the government, medical emergency etc. For a child or a person with a disability, consent will be provided by the parent or legal guardian.
Data Protection Board of India (DPBI)	Provides for the establishment of DPBI by the Central government. Key functions of the Board: Monitoring compliance and imposing penalties. Directing data fiduciaries to take necessary measures in event of a data breach. Hearing grievances made by affected persons. Board members will be appointed for two years and will be eligible for re-appointment. Appeals against decisions will lie with Telecom Disputes Settlement and Appellate Tribunal.
Rights and Duties of Data Principal	Data principal will have the right to Obtain information about processing. Seek correction and erasure of personal data. Grievance redressal. Right to nominate a person to exercise rights in case of death or incapacity. Data principals must not register a false or frivolous complaint and furnish any false particulars. Violation of duties will be punishable with a penalty of up to Rs 10,000
Obligations of Data Fiduciaries	Data Fiduciary (Entity determining the purpose and means of processing) must Ensure the accuracy and completeness of data. Build reasonable security safeguards to prevent a data breach. Inform DPBI and affected persons in the event of a breach. Erase personal data as soon as the purpose has been met and retention is not necessary for legal purposes.
Significant Data Fiduciaries (SDF)	Central Government may notify any Data Fiduciary as SDF, based on factors such as: Volume and sensitivity of personal data processed, Risk to the rights of data principal Potential impact on sovereignty and integrity of India Security of the State, Risk to electoral democracy and Public order SDF will have certain additional obligations including appointing a data protection officer and an independent data auditor and undertaking impact assessment.
Parental Consent	Under Section 9 of the DPDP, 2023 data fiduciaries must obtain verifiable consent from parents or legal guardians before processing children's data. The Act also bans harmful data processing and ad targeting for children (Age below 18).
Exemptions	Rights of the data principal and obligations of data fiduciaries (except data security) will not apply in specified cases, including: For notified agencies, in the interest of security, sovereignty, public order, etc.; For research, archiving or statistical purposes; For start-ups or other notified categories of Data Fiduciaries; To enforce legal rights and claims; o Prevention and investigation of offences; To perform judicial or regulatory functions; To process in India personal data of non-residents under foreign contract. Central government may exempt certain activities in the interest of the security and public order.

Issues of DPDP Act:

Violate Fundamental Rights: Exemptions for State may lead to data collection, processing, and retention beyond what is necessary and may violate fundamental right to privacy.
Missing Rights: Act omits the right to data portability and the right to be forgotten (limiting online disclosure of personal data).
- Data portability allows data principals to obtain and transfer their data from data fiduciary for their own use.
Cross-Border Data Transfer: The Act allows unrestricted data transfer, with the government only restricting certain countries.
State Exemptions and Privacy Risks: Act grants broad exemptions to State, allowing unchecked data processing that may violate privacy rights.
Lack of Harm Regulation: Act does not address risks like identity theft, financial loss, or discrimination arising from data processing.
Data Protection Board Independence: A two-year term with reappointment for Board members may impact independence, increasing executive influence. Other regulators like SEBI and CCI have five-year terms.

Way Forward

Adopt Global Best Practices: Draw from international models like the EU-US Data Privacy Framework to enable secure cross-border data flows.
Encourage Bilateral Agreements: Facilitate secure data transfers through international agreements, avoiding rigid isolationist mandates.
Regulatory Adaptability: Continuously update frameworks to address emerging privacy risks and evolving technologies.
- Dedicated Task Force: Establish an AI-Privacy task force to identify risks and co-create adaptive regulatory measures.
Clear definition: Terms like sovereignty and integrity of India should be clearly defined along with a defined procedure to provide exemption.