Despite the sixteen-and-a-half-month wait for these rules, experts have criticised the rules for being vague and lacking clarity
These draft rules “seek to protect citizens’ rights in accordance with the DPDP Act, while achieving the right balance between regulation and innovation, so that the benefits of India’s growing innovation ecosystem are available to all citizens and India’s digital economy
Image: Shutterstock
On January 3, the Ministry of Electronics and Information Technology (MeitY) published the long-awaited Draft Digital Personal Data Protection Rules, 2025. These rules were eagerly anticipated since the Digital Personal Data Protection Act, 2023, was passed in the Parliament on August 11, 2023. According to news reports, the Minister for Electronics and Information Technology Ashwini Vaishnaw is scheduled to meet industry stakeholders to seek feedback today.
These draft rules “seek to protect citizens’ rights in accordance with the DPDP Act, while achieving the right balance between regulation and innovation, so that the benefits of India’s growing innovation ecosystem are available to all citizens and India’s digital economy”, stated the Press Information Bureau press release.
They provide some clarity on, among others, how data fiduciaries should comply with certain requirements, registration and obligations of consent managers, processing of personal data by the state for subsidies, personal data breaches, details of the data retention period by data fiduciaries amongst others.
One of the more important inclusions is the creation of the Data Protection Board (DPB), an adjudicatory independent body that facilitates complaints resolution and thereby enhances transparency and accountability. “This measure can be used to ensure data privacy has a magnified approach where each case is treated independently,” explains Shravishtha Ajaykumar, associate fellow, Centre for Security, Strategy and Technology, Observer Research Foundation (ORF). The government is now inviting feedback on the draft rules, with a deadline set for February 18, 2025.
Ironically, there is no mention of the word ‘privacy’ in the Draft Digital Personal Data Protection Rules or The Digital Personal Data Protection Act, 2023, published in The Gazette of India. “In fact, the word ‘privacy’ appeared only once in the Digital Personal Data Protection Bill, 2023… which is also where it’s repealing a section of the Right to Information Act,” says Prateek Waghre, technology policy researcher.