The Ministry of Electronics and Information Technology (MeitY) has unveiled the Digital Personal Data Protection Rules, 2025, charting the roadmap for implementing the Digital Personal Data Protection Act, which was enacted in August 2023.
These draft rules lay out guidelines for collecting, storing, and processing personal data, with a sharp focus on user consent, data breach notifications, and safeguarding children’s data. The draft Digital Personal Data Protection Rules, 2025 lay down crucial provisions to ensure data privacy and accountability. One of the key highlights is the Notice and Consent requirement, which mandates that data fiduciaries provide clear notices and obtain explicit consent from individuals before processing their personal data. Another important aspect is the protection of children’s data, with the rules stipulating that verifiable consent from parents or legal guardians is mandatory before processing any data related to children. Additionally, the rules emphasize the importance of Data Breach Notifications, obligating data processors to promptly report any breaches to both the Data Protection Board and the affected individuals, ensuring transparency and quick action in the event of a security lapse.
The government has invited public feedback on the draft rules until February 18, 2025, via the MyGov portal. The final rules will be crafted after considering inputs from stakeholders, marking a major step towards robust data privacy and accountability in India’s digital ecosystem.
