Draft Digital Personal Data Protection Rules, 2025 – Key Highlights

Issued by: Ministry of Electronics and Information Technology (MeitY)

Date: January 5, 2025

Purpose

These rules operationalize the Digital Personal Data Protection Act, 2023 (DPDP Act) to safeguard citizens’ personal data rights while enabling India’s digital economy to flourish. They focus on:

• Empowering citizens to control their data

• Balancing regulation with innovation

• Preventing unauthorized data use, digital harms, and breaches

---

Core Features

1. Citizen-Centric Approach

   • Clear, accessible information on how data is processed

   • Rights to:

     • Informed consent

     • Data erasure

     • Appoint digital nominees

     • Use user-friendly grievance redressal

   • Parental/guardian control for children’s online safety

2. Balance Between Innovation & Regulation

   • Lighter compliance for startups & MSMEs

   • Gradual compliance timelines for all stakeholders

   • Framework seen as a potential global template

3. Digital-First Governance

   • “Born digital” consent, grievance redressal, and Board operations

   • Data Protection Board to work entirely online — no physical presence required

   • Digital platform & app for filing and tracking complaints

4. Stakeholder-Friendly Compliance

   • Graded responsibilities:

     • Higher for Significant Data Fiduciaries (SDFs)

     • Lower for small entities

   • Sector-specific measures can supplement the rules

   • Provisions for annual impact assessments & audits for SDFs

   • Undertaking option: Data Fiduciaries can voluntarily resolve issues to avoid prolonged proceedings

5. Adjudication & Penalties

   • Board to consider nature/severity of default & mitigation efforts before imposing penalties

   • Transparent, time-bound resolution of complaints

6. Inclusivity & Consultation

   • Inputs from diverse stakeholders & global best practices

   • Public feedback invited until 18 Feb 2025

7. Awareness Initiatives

   • Nationwide campaign to educate citizens on data rights & responsibilities

   • Promote a culture of responsible data handling

---

Key Takeaway

The draft rules place citizens at the center, promote ease of compliance, and ensure digital-first governance. They reflect India’s ambition to become a global leader in data protection without stifling innovation.