The Government of India has unveiled the Draft Digital Personal Data Protection Rules, 2025, a comprehensive initiative aimed at fortifying the country’s legal framework to protect citizens’ personal data in the rapidly expanding digital space. These rules prioritize a citizen-centric approach, ensuring individuals are fully informed about how their personal data is processed, granting them the power to give informed consent, request data erasure, and appoint digital nominees.
A key feature of the draft rules is the imposition of Data Fiduciary obligations, holding entities handling personal data accountable for implementing stringent security measures to prevent unauthorized access and breaches. These fiduciaries must also provide users with intuitive systems to manage their data preferences effectively.
A Data Protection Board (DP Board) is proposed to oversee compliance, address grievances, and impose penalties for violations, aiming to streamline complaints and resolve issues efficiently. Additionally, the rules mandate Data Fiduciaries to report any data breach within 72 hours to the DP Board, ensuring timely action and transparency.
While the rules maintain strong protections, they also allow exemptions for data processing in research, archiving, and statistical purposes, ensuring academic and policy research can thrive without compromising privacy standards.
The Ministry of Electronics and Information Technology (MeitY) has invited public feedback on the draft rules until February 18, 2025, reaffirming the government’s commitment to inclusive law-making. Prime Minister Narendra Modi emphasized that these rules reflect India’s dedication to citizen-centric governance, balancing technological innovation with strong privacy regulations. This initiative forms part of India’s broader strategy to build a secure digital economy, protecting citizens’ data while ensuring growth in the digital space.
