Draft Digital Personal Data Protection Rules, 2025

The draft Digital Personal Data Protection Rules, 2025, represent a significant step toward enforcing the fundamental right to informational privacy for Indians, as affirmed by the Supreme Court in the landmark case of Justice K.S. Puttaswamy vs. Union of India (2017).

Background and Context

• The Digital Personal Data Protection Act was passed over a year ago, and the draft rules aim to enforce it.
• The seven-year delay in implementing these rules coincides with rapid digitization, impacting data privacy concerns.

Key Provisions of the Draft Rules

• Online services must communicate the purposes of data collection to users.
• Establish safeguards for children's data online.
• Formation of the Data Protection Board of India (DPBI).
• Set standards for government agencies to be exempt from the Act's provisions.
• Outline procedures in case of personal data breaches by data fiduciaries.

Concerns and Criticisms

• The proposed DPBI's institutional design concerns remain unresolved, potentially unrealistic for subordinate legislation.
• The government has conducted the rule-making process in secrecy, limiting stakeholder engagement.

Recommendations for Transparency and Participation

For legislation with high stakes for individual users and technology firms, an open deliberative process is crucial. This includes:

• Facilitating equal participation of industry associations and the public with transparency into differing viewpoints.

Long-term Goals and Urgency

• The government needs to adhere to principles of minimizing data collection, promoting disclosures, penalizing neglect, and discouraging surveillance.
• Timely implementation is essential for regaining public confidence in data protection commitments.