On January 13, 2025, India’s Ministry of Electronics and Information Technology (MeitY) released draft rules under the much-debated Digital Personal Data Protection (DPDP) Act. These draft rules, now open for public consultation until February 18, 2025, have reignited discussions surrounding their potential impact on data privacy rights in India.
The Draft Digital Personal Data Protection Rules, 2025, outline significant provisions requiring data fiduciaries to obtain verifiable consent from parents before processing minors’ personal data. This aims to strengthen protections for children but also imposes additional compliance burdens on organizations. A key aspect includes the requirement for data to be retained only for as long as necessary, with mandates to delete it upon withdrawal of consent. However, the ambiguity in language has been a point of contention, potentially leading to disparate interpretations and inconsistent application across industries.
One controversial aspect is the absence of specified penalties for rule violations, a point that has raised concerns among privacy advocates. Critics argue that without clear punitive measures, the effectiveness of the DPDP Act may be compromised, leading to insufficient incentives for compliance with data protection norms. The proposed structure of the Data Protection Board (DPB), responsible for overseeing complaints and appeals related to data processing, has also been a subject of debate. Despite government claims that these rules aim to balance regulation and innovation, concerns remain that they might not fully capture the nuances of digital data management in a rapidly evolving technological environment.
Tracing back, the DPDP Act underwent extensive scrutiny. Originally proposed as the Personal Data Protection Bill, it experienced five revisions before its conclusion as law on August 11, 2023. This transformation followed a draft issued in November 2022 that stressed the need for a robust framework to safeguard personal data.
The draft rules are anticipated to evolve in response to feedback from the consultation process, with final regulations expected later this year. As public consultations continue, it’s crucial for stakeholders to take an active role in shaping these regulations, ensuring that individual rights are adequately protected while fostering an environment conducive to innovation.