SYLLABUS

GS-2: Government policies and interventions for development in various sectors and issues arising out of their design and implementation. 

Context: The Union government has notified the rules under the Digital Personal Data Protection (DPDP) Act, formally initiating the implementation of India’s first dedicated digital privacy law.

More on the News

• The notification of the rules comes over two years after the Digital Personal Data Protection Act (DPDP Act) received the President’s assent in August 2023.
• Although the law is now operational, only select provisions are currently in force, with key citizen safeguards expected to roll out over the next 12–18 months.

Key Highlights of the DPDP Rules 2025

• Data Protection Board of India: The Rule operationalises the Board, which will act as the key adjudicatory body to ensure entities comply with the law.
  • The Board will have four members, and its head office will be based in New Delhi.
• Clear and Informed Consent Standards: Data fiduciaries (an entity, either private or public, that collects and processes users’ data) must obtain specific, informed, and plain-language consent, ensuring users understand what data is collected and for what purpose, with simple mechanisms for withdrawal.
• Mandatory Data Breach Reporting: The Rules require Data Fiduciaries to report breaches to both users and the Data Protection Board within defined timelines and maintain logs and corrective-action records.
• Protection of Children and Persons with Disabilities: Strict parental consent is required before processing personal data of children, including restrictions on behavioural tracking. Specialized accessible consent mechanisms are mandated for persons with disabilities.
• Obligations for Data Fiduciary: The data fiduciary will have to implement reasonable security measures to protect personal data, including encryption, access control, monitoring for unauthorised access, and data backups.
• Obligations for Significant Data Fiduciaries (SDFs): SDFs must conduct annual audits, impact assessments, and ensure algorithms and technical systems do not create undue risk, reflecting a higher compliance bar.
  • SDFs will be determined on the basis of the volume and sensitivity of personal data they process, and the risks they might have on national security, electoral democracy, and public order.
• Data Retention and Deletion Requirements: Entities must follow data-minimisation norms, deleting inactive user data after defined periods and storing data only as long as necessary.
• Cross-Border Data Transfer Framework: Personal data may be transferred abroad by default, except to jurisdictions restricted by the government on security or public-interest grounds.

Significance of the DPDP Rules

• Empowering Individuals: Provide rights to withdraw consent, request data corrections, erasures, and address grievances with timely action and transparency.
• Regulatory Clarity: The Rules provide precise definitions of key terms, clear obligations for data fiduciaries, and structured compliance mechanisms, thereby reducing regulatory uncertainty for businesses and enhancing legal predictability.
• Alignment with Global Standards: Brings India’s framework in line with international norms like the EU’s General Data Protection Regulation, aiding global interoperability.
• Push for India’s Digital Economy: By building a trusted regime for data protection, the Rules aim to foster innovation, strengthen user trust, and ensure India remains an attractive destination for global digital business.

About the DPDP Act 2023

• The DPDP Act is India's first comprehensive law for safeguarding the digital personal data of its citizens.
• It establishes a legal framework that recognizes both the right of individuals to protect their data and the need for organizations to process that data for lawful purposes.
• The Act replaces Section 43A of the IT Act, 2000, and supersedes the SPDI Rules, 2011, making the DPDP Act the primary legal instrument governing digital personal data in India.
• Consent-Centric and Rights-Based Framework:
• The Act mandates specific, informed, and clear consent for processing digital personal data.
• Individuals (data principals) gain rights to access, correct, delete, and seek grievance redressal for their data.
• Obligations on Data Fiduciaries & Special Safeguards:
• Data fiduciaries must ensure purpose limitation, data minimisation, security safeguards, and timely breach reporting.
• Additional protections apply for children’s data, including banning profiling or targeted advertising.
• Governance, Enforcement & Cross-Border Rules:
• Establishes the Data Protection Board of India to enforce compliance and impose monetary penalties.
• Allows cross-border data transfer by default, with the government empowered to restrict certain jurisdictions for security or public interest.
• Penalties: The Act provides for steep financial penalties (up to ₹250 crore) for breaches related to children’s data, security failures, and non-compliance with obligations.

Sources:
Bussiness standard
The Hindu
New Indian Express
Live Mint