On January 3, 2025, the Ministry of Electronics and Information Technology (MeitY) released the draft of the Digital Personal Data Protection (DPDP) Rules, 2025, for public consultation. These rules operationalize the DPDP Act, 2023, India’s first law focused on personal data protection, which received presidential assent on August 11, 2023. The rules aim to provide a robust regulatory framework to safeguard individuals’ privacy in the digital age.
Rules Overview
Transparency and Consent
- Rule 3: Data Fiduciaries must provide clear, plain-language notices about data usage, purpose, and how data principals can exercise their rights.
Role of Consent Managers
- Rule 4: Consent Managers must be registered entities, ensuring individuals can manage, review, and withdraw consent securely.
Security Measures
- Rule 6: Data Fiduciaries must implement encryption, data masking, access control, and breach detection protocols.
Breach Notifications
- Rule 7: Breaches must be reported to affected individuals and the Data Protection Board within 72 hours.
Data Retention and Erasure
- Rule 8: Mandates erasure of data when it is no longer required, with specific retention periods for entities like e-commerce platforms.
Processing for Vulnerable Groups
- Rules 10 & 11: Require verifiable parental consent for processing children’s data, with some exemptions for essential services.
Significant Data Fiduciaries
- Rule 12: Obligates Significant Data Fiduciaries to conduct yearly Data Protection Impact Assessments (DPIAs) and audits, ensuring transparency in algorithms.
Data Transfer and Exemptions
- Rule 14: Regulates cross-border data transfers to ensure equivalent protection.
- Rule 15: Exempts research, archiving, and statistical processing under strict conditions.
Governance Framework
- Rules 16–20: Detail the structure, functioning, and responsibilities of the Data Protection Board, including the appointment of Chairperson and Members.
Appeals and Information Requests
- Rule 21: Allows appeals to the Appellate Tribunal.
- Rule 22: Permits the government to request information from Data Fiduciaries or intermediaries for specified purposes.
What’s Next for Stakeholders?
- The draft rules are open for feedback on the MyGov portal.
- Final rules will be enforced in phases, with delayed timelines for some provisions (e.g., Rules 3–15, 21–22).
Practical Steps for Organizations
- Conduct Data Audits: Map and document data processing activities.
- Update Security Systems: Implement encryption and access controls.
- Enhance Privacy Policies: Ensure compliance with DPDP rules.
- Train Employees: Educate staff about compliance requirements.
- Engage Experts: Seek professional guidance for DPIAs and cross-border data handling.
Conclusion
The DPDP Rules, 2025, offer a structured approach to protecting personal data and ensuring accountability. Organizations should use this phase to align practices, enhance systems, and prioritize compliance. By partnering with experts like Securitybulls, businesses can navigate the complexities of these regulations efficiently and confidently.
