The MeitY has released the Draft Digital Personal Data Protection Rules, 2025 for public consultation. These rules, once notified, will facilitate the implementation of the Digital Personal Data Protection Act (DPDP Act), 2023.
The Act's journey began with the Justice AP Shah Committee's recommendation for privacy legislation in 2011 and the Supreme Court's landmark recognition of privacy as a fundamental right in the Justice KS Puttaswamy (Retd.) vs Union of India case in 2017.
The Act applies to digital personal data processing in India, whether collected online or offline and subsequently digitized.
The Act mandates that Data Fiduciaries (entities determining the purpose and method of data processing) obtain explicit user consent before processing personal data. However, certain exceptions exist for legitimate uses such as voluntary data provision, government services or benefits, and medical emergencies. F
or processing children's data, verifiable consent from a parent or lawful guardian is required. Significant Data Fiduciaries, as notified by the Central Government, must appoint a Data Protection Officer (DPO) based in India to manage grievance redressal mechanisms.
The Act grants users several rights, including access to a summary of how their personal data is processed, the entities it is shared with, and other related information.
Enforcement is ensured through the Data Protection Board (DPB), which has civil court powers to address data breach complaints.
Guidelines:
1) Users must be informed immediately of any breaches, including their nature, consequences, and safety measures.
2) Simultaneously, the DPB must be alerted without delay, with a detailed report submitted within 72 hours.
3) For data retention, big platforms are required to delete user data after three years of inactivity, providing 48-hour advanced notice before deletion, except where retention is legally mandated.
4) Parental verification for children's data must be done using reliable identification or government-authorized tokens, though exemptions are allowed for healthcare, education, welfare services, school transport safety, and email account creation.