Data PrivacyDraft Digital Personal Data Protection Rules, 2025 for Data Privacy Tribe

The Digital Personal Data Protection Rules, 2025,(DPDP Rules,2025) proposed by the Ministry of Electronics and Information Technology, consist of 22 rules and 7 schedules.

It is open to suggestions till 18th February,2025 to Meity.

Context and Significance

The draft DPDP Rules, 2025, represent a significant milestone in India’s evolving data protection framework. They are part of a broader legislative effort to regulate the processing of personal data, following the enactment of the Digital Personal Data Protection Act, 2023

Key Provisions and Main Factors

1. Notice and Consent: Data Fiduciaries must provide clear, plain-language notices to Data Principals before processing their personal data. These notices must include the purpose of data processing, a description of the personal data being processed, and means for withdrawing consent.
2. Consent Management: The rules introduce the concept of Consent Managers, entities that facilitate the giving, managing, and withdrawal of consent by Data Principals. Consent Managers must be registered with the Data Protection Board and maintain records of consents.
3. Security Safeguards: Data Fiduciaries are required to implement reasonable security measures to prevent personal data breaches, including encryption, access control, and monitoring of data access.
4. Data Breach Notification: In the event of a personal data breach, Data Fiduciaries must notify affected Data Principals promptly and inform the Data Protection Board within 72 hours.
5. Processing of Children’s Data: Special provisions apply to the processing of personal data of children under 18 years, including obtaining verifiable consent from parents or guardians.
6. Significant Data Fiduciaries: Entities classified as Significant Data Fiduciaries have additional obligations, such as conducting annual Data Protection Impact Assessments and audits.
7. Cross-Border Data Transfers: The rules restrict the transfer of personal data outside India unless approved by the Central Government.
8. Rights of Data Principals: Data Principals have the right to access, correct, or erase their personal data, and withdraw consent for data processing.
9. Governance and Oversight: The Data Protection Board is responsible for overseeing compliance with the rules, handling grievances, and enforcing penalties for violations.

Schedules

The seven schedules in the draft DPDP Rules, 2025, provide detailed standards and conditions for various aspects of data protection:

1. First Schedule: Conditions for registration and obligations of Consent Managers
2. Second Schedule: Standards for processing personal data by the State
3. Third Schedule: Time periods for data retention by specific classes of Data Fiduciaries
4. Fourth Schedule: Exemptions for processing children’s data
5. Fifth Schedule: Terms of service for the Chairperson and Members of the Data Protection Board
6. Sixth Schedule: Terms of service for officers and employees of the Board
7. Seventh Schedule: Authorized persons for specific purposes under the Act

Potential Impact and Significance

The draft DPDP Rules, 2025, are expected to have far-reaching implications for businesses, government agencies, and individuals. They aim to enhance data protection, align with global standards, and empower individuals with greater control over their personal data.

The rules are anticipated to foster trust in digital interactions, potentially driving innovation and economic growth while safeguarding individual rights.

However, implementing these rules may present challenges, such as the need for technological upgrades and the development of new compliance mechanisms. Businesses may face increased operational costs to ensure compliance, but this could be offset by enhanced consumer trust and new opportunities in privacy-enhancing technologies.

Conclusion

The draft DPDP Rules, 2025, represent a comprehensive framework for data protection in India.

By addressing key aspects such as consent management, data security, and individual rights, these rules aim to establish a robust regulatory environment that balances innovation with privacy protection.

As the rules undergo public consultation, their final form will likely shape the future of data governance in India’s digital economy.

Team AMLEGALS 

For any queries or feedback, feel free to connect to mridusha.guha@amlegals.com