Digital Personal Data Protection Rules (DPDP) 2025 : Context

• The Government of India has notified the DPDP Rules, 2025, completing the operationalisation of the DPDP Act, 2023.
• This follows the 2017 Supreme Court judgment recognising privacy as a fundamental right.
• The Rules detail compliance mechanisms and clarify the roles of Data Principals, Data Fiduciaries, and the Data Protection Board of India (DPBI).

Key Features of the DPDP Act & Rules

1. Citizen-Centric Legal Design

• SARAL framework (Simple, Accessible, Rational, Actionable) using plain language and illustrative compliance.
• Clear articulation of rights and duties.

2. Rights and Duties

• Data Principals (citizens): Right to informed consent, correction, erasure, and grievance redressal.
• Data Fiduciaries (entities): Lawful processing, security safeguards, breach reporting, and accountability.

3. Phased Implementation

• Immediate:
  • DPBI operationalised (four members; HQ in New Delhi).
  • Amendment to the RTI Act, 2005 restricting disclosure of “personal information”.
• Delayed (12–18 months):
  • Informed consent and purpose limitation.
  • Mandatory breach notification to users.
  • Appointment of Data Protection Officers (DPOs).
  • Consent Manager Framework (target: Nov 2026).
  • Full compliance for large tech firms (target: May 2027).

4. Data Fiduciaries & Significant Data Fiduciaries (SDFs)

• Classification criteria: Volume/sensitivity of data; impact on sovereignty, democracy, national security, and public order.
• Obligations for SDFs:
  • Higher compliance thresholds.
  • Data Protection Impact Assessments.
  • Mandatory parental consent verification for children’s data.

5. Data Localisation & Cross-Border Transfers

• Conditional localisation introduced.
• Government to notify categories of personal/traffic data barred from transfer abroad via a committee.
• Industry concerns over interoperability and digital trade implications.

6. Children’s Data

• Verifiable parental consent mandated.
• No prescribed model—flexibility to firms.
• Behavioural tracking/targeted ads generally prohibited; limited processing allowed to prevent exposure to harmful content.

7. Breach Notification & Penalties

• Immediate user intimation required: nature, extent, timing, consequences, and mitigation.
• Penalties up to ₹250 crore for failure to prevent breaches.
• DPBI empowered to investigate and penalise.

Criticisms and Concerns

• Transparency vs Privacy: RTI amendment weakens public-interest override for personal information of public officials.
• State Exemptions: Broad exemptions for the State and its instrumentalities risk unchecked processing.
• Localisation Pushback: Compliance burden for global firms; potential trade frictions.
• Delayed Protections: Core citizen safeguards deferred by 12–18 months.
• Parental Consent Ambiguity: Risk of inconsistent practices.
• Institutional Capacity: Four-member DPBI may be inadequate for scale.
• Startup Burden: Disproportionate compliance costs for small firms.

Way Forward

• Strengthen DPBI independence and capacity with staffing and resources.
• Clarify localisation norms through stakeholder consultation and interoperable transfer mechanisms.
• Rebalance transparency by revisiting RTI-related changes.
• Provide transition support: standard templates for consent, breach reporting, and consent management.
• Build public awareness via digital literacy campaigns.
• Enhance baseline security standards: audits, incident response, minimum cybersecurity norms.

Conclusion

The DPDP Act, 2023 and Rules, 2025 mark a landmark in India’s data protection regime, aiming to balance privacy, innovation, national security, and public order. Their success will hinge on timely implementation, clear guidance, institutional capacity, and continuous stakeholder engagement to ensure rights are protected without stifling innovation.