India Releases Draft Digital Personal Data Protection Rules, 2025 for Public Consultation

In a significant move towards strengthening data privacy, the Ministry of Electronics and Information Technology (MeitY) has unveiled the Draft Digital Personal Data Protection Rules, 2025. Released on January 3, 2025, these draft rules aim to operationalize the Digital Personal Data Protection Act, 2023 (DPDP Act), which received presidential assent on August 11, 2023. Stakeholders and the general public are invited to provide feedback by February 18, 2025.

Background of the DPDP Act

The DPDP Act establishes a comprehensive framework for processing digital personal data in India. It seeks to balance an individual’s right to data protection with the necessity of processing such data for lawful purposes. The Act’s applicability extends to the processing of digital personal data within India and includes certain extraterritorial provisions, especially concerning activities related to offering goods or services to individuals in India.

Key Features of the Draft Rules

• Data Fiduciary Obligations: Emphasizing transparency, fiduciaries must obtain specific and informed consent from individuals, clearly outlining what data is collected and why.
• Consent Managers: Entities introduced to help individuals manage their consent efficiently across platforms.
• Data Protection Board of India: An adjudicatory body to oversee compliance and address breaches or grievances.

Why the Buzz?

The DPDP Act has sparked intense debate across sectors — from tech giants to privacy advocates. Many are drawing comparisons with the European Union’s General Data Protection Regulation (GDPR), given their shared focus on informed consent, data minimization, and accountability. However, there are some key differences:

• Government Exemptions: Unlike GDPR, the Indian law provides broad exemptions to government agencies, raising concerns about surveillance and misuse.
• No Data Localization: While earlier drafts insisted on storing data within India, the current version allows cross-border transfers, a move welcomed by tech companies but criticized by nationalists.
• Notice & Consent Simplified: The draft follows the SARAL principle (Simple, Accessible, Rational, Actionable, and Layered) to ensure even the average citizen can understand how their data is used.

Public Consultation & Implications

The government has invited suggestions through the MyGov portal, and stakeholders are urged to respond before February 18. The final version of these rules will shape how businesses collect, store, and process data — and how citizens interact with digital services going forward.

Conclusion

With India emerging as one of the largest digital economies, the release of these draft rules is both timely and crucial. The hope is that the law will strike a balance between innovation and privacy, without tilting too heavily towards state control or corporate interests.