The Digital Personal Data Protection Rules

The Union government has released the draft Digital Personal Data Protection (DPDP) Rules, 2025 for public consultation until February 18.

• The rules are notified by the Ministry of Electronics and Information Technology and will enforce the provisions of the Digital Personal Data Protection Act, 2023.

Features of the Digital Personal Data Protection Draft Rules

• Informed Consent: The rules specify the nature of the personal data collection of the users by the data fiduciaries ie. the kind of data they’re collecting, the reason for collecting it and how the data will be processed.
• Digital by Design: Data Protection Board for consent mechanisms and grievance redressal, for faster resolution of complaints and grievances online.
• Exemption: The government and its agencies are exempted from certain compliances related to  data for the purpose of providing subsidies and benefits. Data collected for “statistical” purposes is also exempt.
• Data Protection: A data fiduciary shall protect personal data in its possession by providing for technical and operational safeguards like, within 72 hours of a data breach, the data fiduciary should inform the the Data Protection Board of India (DPBI)
• Deletion: The user data of an inactive account should be deleted by an e-commerce provider, social media platform, or online gaming service after providing 48 hours of advance notice and time to stop deletion. 

Enroll now for UPSC Online Classes

• Assessment and Audit: Significant data fiduciaries must periodically conduct a “Data Protection Impact Assessment” and an audit to ensure effective observance of the provisions of this Act
• Verifiable Parental Consent: Appropriate technical and organisational measures shall be adopted to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child
  • Data Fiduciaries needs to rely on voluntarily provided details of identity and age or a virtual token mapped to the same, which is issued by an entity entrusted by law 
• Consent Managers: Entities responsible for managing user consent must ensure accurate verification and provide users with a mechanism to withdraw consent.  They must also maintain detailed records of all users who have given or withdrawn consent.
• Data Localization: As per this provision, certain personal data must be stored within India and cannot be transferred abroad. A government committee will determine which categories of data (e.g., health or financial data) cannot be transferred outside the country.
• Penalties and Enforcement: Non-compliance with the data protection rules can lead to penalties of up to ₹250 crore with repeat offenders facing suspension or cancellation of their licenses.

Concerns Regarding the DPDP Rules 2025 

• Discretionary Powers: The Union Government and Data Fiduciaries are granted certain discretionary powers such as for determining exemptions, processing standards, data retention, data localisation etc,  giving the Government excessive power without clear criteria. 
• Oversight and Accountability: The DPDP Rules do not establish strong enforcement or oversight mechanisms as there is no explicit provision for independent audits or compliance monitoring.
  • Also there is a failure to create a regulatory framework through an independent Data Protection Authority.
• Exemptions for State Processing: State and its agencies are allowed to process personal data for broad purposes, such as issuing subsidies, benefits, or services, under laws, policies, or public funds. However the scope and limits of such processing has not been specified creating  room for potential misuse
• Universal Mandatory Registration: The Government asks for age verification to check the minor status of a person and may in future require every online user to verify their age through Government credentials resulting in potential mass surveillance with Government IDs linked to every user’s online credentials.

Check Out UPSC NCERT Textbooks From PW Store