By emphasising informed consent, data security and accountability, the proposed guidelines seek to balance innovation with regulation
India has made a landmark move toward establishing a robust data protection framework with the release of the draft Digital Personal Data Protection Rules, 2025. This follows the passage of the Digital Personal Data Protection Act, 2023, by Parliament in August 2023. While the Act is yet to be implemented, the draft rules provide a glimpse into the envisioned system for managing and safeguarding personal data in the digital age. The draft rules emphasise transparency, particularly in mandatory notice requirements to ensure individuals, referred to as data principals, are well-informed before consenting to the collection and processing of their data. These notices must be standalone documents, free from being buried in terms of use or privacy policies. By allowing flexibility in their format, the rules aim to strike a balance between clarity and practicality, enabling organisations to provide meaningful notices without undue rigidity. Another critical element is the obligation on data fiduciaries to implement reasonable security safeguards to protect personal data. While baseline measures are outlined, businesses are given the flexibility to tailor these safeguards to their specific contexts, avoiding a one-size-fits-all approach.
In the event of data breaches, fiduciaries must notify affected individuals and the Data Protection Board of India. However, the rules lack clarity on notification timelines, requiring disclosure ‘without delay’ but failing to define what constitutes a reasonable timeframe. The dual-stage notification process, involving an initial report followed by a detailed submission within 72 hours, may pose practical challenges in meeting such requirements. Retention of personal data is another area of focus. The draft advocates for data erasure once the purpose of processing is fulfilled. However, prescribed retention periods are limited to specific entities such as large e-commerce platforms and social media intermediaries, leaving others to set their own timelines. This selective approach may create inconsistencies in compliance practices. Provisions for cross-border data transfers add complexity by restricting personal data movement to jurisdictions identified by the Indian government. This requirement introduces additional compliance steps for organisations but leaves questions about handling existing data in restricted jurisdictions. The concept of consent managers, introduced in the Act, is further elaborated in the draft rules. These intermediaries will help individuals manage their data rights through interoperable platforms, potentially simplifying compliance for businesses but also increasing operational costs. Despite its progressive stance, the draft has drawn criticism for perceived vagueness and delayed release. Concerns include the overreach of localisation mandates, ambiguous provisions for minors’ data protection, and the practical difficulties of verifying parental consent. While challenges remain, the draft rules represent a significant step toward aligning India’s data protection framework with global standards.
