All you wanted to know about the Draft Digital Personal Data Protection Rules, 2025
A detailed explainer on the provisions and implications of the Draft Digital Personal Data Protection Rules, 2025.
Published on: 19 January 2025, 07:01 am
ON January 3, 2025, the Ministry of Electronics and Information Technology (MeitY) released the Draft Digital Personal Data Protection Rules (DPDP Rules). The government invited suggestions and objections from stakeholders via the MyGov portal, with a submission deadline of February 18, 2025. An explanatory note accompanied the draft Rules to provide further context.
The draft Rules, consisting of 22 provisions and Seven Schedules, aim to operationalise the Digital Personal Data Protection Act, 2023 (DPDP Act). These Rules clarify crucial aspects, including consent management, security safeguards and procedures for handling personal data breaches.
The DPDP Act represents a significant shift in India’s approach to data privacy. It builds on years of recommendations and judicial decisions that have shaped personal data protection in the country.
In 2011, the Justice A.P. Shah Committee laid the foundation for this legislative framework by recommending privacy laws to safeguard individual data rights. This effort gained momentum after the Supreme Court’s landmark 2017 ruling in Justice K.S. Puttaswamy (Retd.) versus Union of India, which recognised the right to privacy as a fundamental constitutional right.
In 2017, MeitY formed a committee of experts led by former Supreme Court Justice B.N. Srikrishna to address data protection issues in India and draft a data protection Bill. Following extensive deliberations, the Joint Parliamentary Committee (JPC) adopted a draft report on The Personal Data Protection Bill, 2019, on November 22, 2021.
Despite this progress, the government abruptly withdrew the legislation in October 2022 before the Parliament could consider it. Subsequently, MeitY re-examined the issues surrounding digital personal data protection and drafted the DPDP Bill in 2022.
The DPDP Act attempts to establish a comprehensive legal framework for digital personal data protection in India. It balances the rights of individuals to safeguard their personal data with societal needs and the lawful purposes of data processing. The Act applies to processing digital personal data collected online or offline, provided it is eventually digitised.