Draft Data Protection Rules Can Be Improved

Issues around overbreadth, clarity, and discretionary power being placed in the hands of State agencies call for wider discussion

- Gautam Bhatia

On January 3, 2025, the ministry of electronics and information technology released the Draft Digital Personal Data Protection Rules, 2025, for public consultation. These rules are proposed to be enacted under the authority of the Digital Personal Data Protection Act, 2023, and in order to implement the provisions of that Act.

The publication of the draft rules marks a significant milestone, as they are necessary before the Data Protection Act can actually be implemented in a way that effectively protects the rights of Indian citizens. With that said, however, in their present form, the rules suffer from various potential flaws, which might hamper the ability of the law to perform that function.

First, there is the procedure for the selection of the chairperson and members of the Data Protection Board (DPB) itself. The Data Protection Board is crucial to the functioning of the Act, as it constitutes, in essence, the infrastructure through which the law will be implemented.