Government Implements Digital Data Protection Rules

Summary of the Digital Personal Data Protection (DPDP) Framework

Constitutional and Legislative Framework

• DPDP Act, 2023: Enacted on 11 August 2023, establishing a comprehensive framework for the protection of digital personal data.
• DPDP Rules, 2025: Notified, operationalizing the Act with a focus on citizen rights and responsible data use.
• Adheres to seven core principles:
  • Consent & Transparency
  • Purpose Limitation
  • Data Minimization
  • Accuracy
  • Storage Limitation
  • Security Safeguards
  • Accountability

Key Features of DPDP Rules

• Design Principles: SARAL (Simple, Accessible, Rational, Actionable) approach for clarity in compliance.
• Stakeholder Consultation: Rules developed after public consultations across major cities including Delhi, Mumbai, and others, incorporating inputs from various sectors.

Implementation and Compliance

• Phased Implementation: An 18-month compliance timeline for organizations to adjust to new regulations.
• Consent Management: Data Fiduciaries required to provide clear consent notices; Consent Managers must be Indian firms.
• Breach Notification Protocol: Obligates Data Fiduciaries to inform affected individuals promptly about data breaches in plain language.

Special Provisions

• Children's Data Protection: Verifiable consent required for processing children's data, with limited exemptions.
• Support for Persons with Disabilities: Consent for personal data process must be obtained from a legal guardian in specific cases.

Rights of Data Principals

• Strengthening of individual rights to access, correct, update, or erase personal data.
• Obligatory response time by Data Fiduciaries for such requests: 90 days.

Establishment of Regulatory Bodies

• Digital-First Data Protection Board: A fully digital entity for handling complaints, with an online platform and app for ease of access.
• Appeals Mechanism: Decisions can be appealed to the Appellate Tribunal at TDSAT.

Economic and Innovation Impact

• The framework is designed to stimulate economic growth while ensuring robust data protection, fostering trust in the digital economy.
• Aims to maintain a balance between citizen privacy and technological innovation.
• A technology-neutral approach to facilitate compliance for startups and small enterprises.

Resources

• Additional information and the full framework can be accessed via the Ministry of Electronics and Information Technology (MeitY) website: MeitY Website

This new regulatory framework aims to position India's data governance model as secure, resilient, and competitive in the global digital economy while safeguarding citizens’ privacy rights.