India unveils draft rules for DPDP Act, opens public consultation

The DPDP draft rules aim to safeguard personal data while balancing user privacy, regulatory oversight, and operational flexibility for businesses

- BY SHUBHENDU PARTH

The Ministry of Electronics and Information Technology (MeitY) has released the much-anticipated draft rules for the Digital Personal Data Protection (DPDP) Act, 2023. Passed by Parliament in August last year, the Act is a landmark step toward safeguarding personal data in India. The draft rules, unveiled on 3 January, are open for public consultation until 18 February 2025.

The DPDP Act, designed to provide robust safeguards against misuse of personal data, has been eagerly awaited by the industry for clarity on compliance and operational responsibilities. The draft rules outline key provisions, including mechanisms for data protection, user rights, and establishing a regulatory framework.

WHAT DOES THIS MEAN FOR INDIA?

The draft rules move India closer to joining the global league of nations with comprehensive data protection frameworks. They mandate explicit consent for data processing, set conditions for cross-border data transfers, and require stringent measures for handling breaches.

Provisions for minors' data and guidelines for the Data Protection Board (DPB) highlight the government's intent to balance user privacy with operational flexibility for businesses.

The regulations address crucial aspects such as data collection notifications, a consent management framework, and safeguards for processing children's personal information.

WHAT DO THE DRAFT RULES SAY?