INDIA'S ODYSSEY TO A ROBUST PERSONAL DATA PROTECTION REGIME

India's Digital Personal Data Protection Act marks a pivotal moment in digital governance, setting the stage for comprehensive data privacy and security frameworks.

- TV RAMACHANDRAN

The creation of the first-ever Digital Personal Data Protection Act (DPDP Act) was a historic milestone in the annals of India's digital progress. Following this notification on 11 August 2023, India's Ministry of Electronics and IT (MeitY) launched a marathon Odyssey to discover and develop the optimum rules to implement the Act effectively.

The Odyssey sailed through nine stakeholder consultations across major cities, including Delhi, Bengaluru, Mumbai, Hyderabad and Chennai. The eventful voyage, lasting close to 18 months of intensive discussions and consultations, resulted in the release of comprehensive DPDP Rules on 3 January 2025. The MeitY sought responses and feedback from stakeholders till 18 February. When refined and finalised based on stakeholder comments, these rules can be a big march forward in the alignment of India's data protection framework with global best practices.

The Rules appear to strike a commendable balance between regulation and innovation while prioritising the privacy of Indian citizens. The primary objective of India's data protection law is to safeguard personal data, establishing clear obligations for data fiduciaries, rights for data principals, provisions for verifiable children's consent, exemptions, and guidelines for cross-border data flows.

India’s data protection framework presents a unique opportunity to establish a robust, citizen-centric digital ecosystem. With that in mind, further refinement of the rules, focusing on clarity and minimising ambiguities, would be beneficial in a few areas.

NEED FOR A PHASED IMPLEMENTATION