DPDP Act 2025 - Features and Views

This is an effort to protect personal data according to international ethics. Are there pitfalls?

- DR ARCHANA VERMA

MeitY has prepared a Digital Personal Data Protection (DPDP) Act 2025 and has invited consultation from the public on its website. The Act is in the Draft form at the moment and the last date for making suggestions to the government is 18th of February.

Before we present the views of the IT business community, let’s first understand what the features are of this Act.

In a Nutshell

Speaking briefly, DPDP Act 2025 is an effort to protect personal data against misuse and security infringements. Following are its main features –

Data Minimisation – The Act requires the organisations to collect and process only the minimum amount of personal data essential for a special purpose. There should not be large volumes of data collections, which may cause data breaches and increase security risks.

Accuracy – Organisations must take steps to ensure that personal data remains accurate and up-to-date. This safeguards individuals from harm caused by inaccuracies and upholds the integrity of data processing activities.

Retention – The DPDP Act mandates that organisations should keep personal data only as long as necessary to meet the goal for which it was obtained. Not following this can attract legal action.It is felt that shorter duration of data retention will lead to lesser risk of data breach.

Transparency – The DPDP Act requires the organisations to process data in a transparent manner. Organisations must keep the data-related persons in the know about how their data is processed, their rights and how to exercise them. In case of a data breach, they must inform the person whose data is breached about the security breach.

Accountability – The Act mandates that the organisations must