<p>New Delhi: The government floated draft Digital Personal Data Protection (DPDP) Rules 2025 last week for public consultation till February 18.</p>.<p><strong>Here is an explainer of the draft DPDP Rules 2025: </strong></p><p><strong>What are the draft Digital Personal Data Protection Rules 2025? </strong></p><p>The Digital Personal Data Protection (DPDP) Rules 2025 drafted by the government provides for the manner of implementation of the Digital Personal Data Protection Act, 2023. Rules are framed to operationalise Acts that have been passed by Parliament.</p>.<p>The draft rules are open for public comment for 45 days till February 18, 2025, and citizens can submit their comments on the MyGov website.</p>.<p>These rules have spelt out a framework for setting up the Data Protection Board (DPB) -- which will function in digital mode as per the DPDP Act 2023.</p>.<p>The rules have clarified the process to be undertaken for processing data of children where entities are required to adopt technical and organisational measures to ensure that verifiable consent of parents is obtained for processing the personal data of a child.</p>.<p>The rules provide for the transfer of personal data outside India, but only of certain as approved by the government from time to time.</p>.<p>The draft rules envisage a committee that may recommend restrictions on such transfer by a significant data fiduciary with respect to specified personal data.</p>.Digital Personal Data Protection rules focus on citizen rights: PM Modi.<p><strong>What is the DPDP Act? </strong></p><p>The Digital Personal Data Protection Bill 2023 was introduced in the Lok Sabha on August 3, 2023, and was passed in the Lower House on August 7, 2023.</p>.<p>Thereafter, it was introduced in the Rajya Sabha on August 9 and was passed on the same day. It became the Digital Personal Data Protection Act 2023 after the President's approval on August 11.</p>.<p><strong>What is the need for the DPDP Act? </strong></p><p>While digitisation using the personal data of individuals has transformed the delivery of services enhancing ease of living, it is also increasingly at risk of misuse. Therefore, it has become imperative that digitised personal data be protected.</p>.<p>The DPDP Act 2023, obligates data fiduciaries to protect personal data and makes them accountable. Digital platforms cannot collect only those data that are required for their functioning and providing services which users have opted for. For example, a user will not have to give a microphone or contact access to use a torch app on their mobile phone.</p>.<p><strong>How will the DPDP Act 2023 help people? </strong></p><p>The Act provides consent-based personal data processing by digital platforms.</p>.<p>This means digital platforms will have to inform and get consent from people in English or any of the 22 Indian languages listed in the Constitution, in the language of their choice.</p>.<p>They will also have to notify their users of the online links using which they may exercise their rights for withdrawing their consent, obtaining information regarding processing their data, updating and erasure of their data, grievance redressal, nomination and making a complaint to the DPB.</p>.<p>The digital platform may also collect consent through consent managers, an independent digital platform operated by a different entity.</p>.<p><strong>Who are consent managers? </strong></p><p>The Reserve Bank of India (RBI) has created an account aggregator framework under which apps like Finvu, OneMoney, CAMS Finserv, etc, share financial information based on consent and for specific purposes.</p>.<p>The National Health Authority of India has also set up a Health Information Exchange that empowers citizens to securely access and share their health records, ensuring that data exchange is driven by informed consent. Such platforms may work as consent managers if they are approved by the DPB.</p>.<p><strong>Who are data fiduciaries? </strong></p><p>Entities such as social media platforms, e-commerce companies and online gaming platforms, etc, that collect and process an individual's personal data are data fiduciaries. They can use such data only after the individual's consent for specified purposes.</p>.<p>Digital platforms with a large number of users such as Facebook, Instagram, YouTube, Amazon, Flipkart, Netflix, etc, will qualify as significant data fiduciaries.</p>.<p><strong>Will the Act help in acting against spam calls? </strong></p><p>Yes. While the Telecom Regulatory Authority of India (TRAI) has issued rules for action on spam or pesky calls, citizens can take recourse under the DPDP Act 2023 as well. The DPB can impose a monetary penalty on entities found processing personal data, without consent, in violation of the Act.</p>.<p><strong>How can people file complaints? </strong></p><p>The DPB will function as a digital office. It will operate through a digital platform and app to enable citizens to approach it digitally and have their complaints adjudicated without their physical presence.</p>.<p>The government has prepared the entire digital framework, the digital platform, and the entire processes for this. </p><p><strong>What are the penalty provisions under the DPDP Act 2025? </strong></p><p>The draft rules do not elaborate on the penalty but spell out a mechanism to set up a DPB that will levy penalties based on the nature of the breach as listed in the DPDP Act 2023.</p>.<p>The DPDP Act 2023 has provisions to impose penalties of up to Rs 250 crore on data fiduciaries. The Act provides for graded financial penalties in case of violation of the Act and the rules.</p>.<p>The quantum of penalty will depend on the nature, gravity, duration, type, repetitiveness, efforts made to prevent a breach, etc. Further, significant data fiduciaries have higher obligations under the Act and rules, while a lower compliance burden is envisaged for startups.</p>.<p>Moreover, the data fiduciary may at any stage in the proceedings voluntarily give an undertaking to the Data Protection Board, which, if accepted, would result in the dropping of proceedings.</p>.<p>When will the rules be rolled out? The final rules will be placed before Parliament after the ongoing consultation process during the monsoon session. Thereafter, the government may take around two years to implement the DPDP Act 2023. All digital entities and consent managers will have time till then to check and put systems in place to comply with the Act.</p>.<p><strong>What are the exemptions? </strong></p><p>There are few exemptions from the provisions of the DPDP Act -- like performing judicial and regulatory functions under the law; enforcing legal rights and claims; preventing, detecting, investigating or prosecuting any offence; locating defaulters and their financial assets, etc.</p>.<p>There are some exemptions for certain data fiduciaries, including startups and performing research, etc.</p>.<p><strong>Will the DPDP Act 2023 be of help to people who do not have access to digital technologies? </strong></p><p>Yes. In case a person with no access to digital technology is impacted due to digital misuse of his personal data or details, the same recourse is available for that person as anyone who is digitally connected.</p>.<p>Under the DPDP Act 2023, the same recourse is available to both types of persons, irrespective of their access to digital technologies.</p>.<p><strong>What is the timeline for filing a complaint? </strong></p><p>There is no time limit for filing complaints under the DPDP Act 2023 as of now. </p>
<p>New Delhi: The government floated draft Digital Personal Data Protection (DPDP) Rules 2025 last week for public consultation till February 18.</p>.<p><strong>Here is an explainer of the draft DPDP Rules 2025: </strong></p><p><strong>What are the draft Digital Personal Data Protection Rules 2025? </strong></p><p>The Digital Personal Data Protection (DPDP) Rules 2025 drafted by the government provides for the manner of implementation of the Digital Personal Data Protection Act, 2023. Rules are framed to operationalise Acts that have been passed by Parliament.</p>.<p>The draft rules are open for public comment for 45 days till February 18, 2025, and citizens can submit their comments on the MyGov website.</p>.<p>These rules have spelt out a framework for setting up the Data Protection Board (DPB) -- which will function in digital mode as per the DPDP Act 2023.</p>.<p>The rules have clarified the process to be undertaken for processing data of children where entities are required to adopt technical and organisational measures to ensure that verifiable consent of parents is obtained for processing the personal data of a child.</p>.<p>The rules provide for the transfer of personal data outside India, but only of certain as approved by the government from time to time.</p>.<p>The draft rules envisage a committee that may recommend restrictions on such transfer by a significant data fiduciary with respect to specified personal data.</p>.Digital Personal Data Protection rules focus on citizen rights: PM Modi.<p><strong>What is the DPDP Act? </strong></p><p>The Digital Personal Data Protection Bill 2023 was introduced in the Lok Sabha on August 3, 2023, and was passed in the Lower House on August 7, 2023.</p>.<p>Thereafter, it was introduced in the Rajya Sabha on August 9 and was passed on the same day. It became the Digital Personal Data Protection Act 2023 after the President's approval on August 11.</p>.<p><strong>What is the need for the DPDP Act? </strong></p><p>While digitisation using the personal data of individuals has transformed the delivery of services enhancing ease of living, it is also increasingly at risk of misuse. Therefore, it has become imperative that digitised personal data be protected.</p>.<p>The DPDP Act 2023, obligates data fiduciaries to protect personal data and makes them accountable. Digital platforms cannot collect only those data that are required for their functioning and providing services which users have opted for. For example, a user will not have to give a microphone or contact access to use a torch app on their mobile phone.</p>.<p><strong>How will the DPDP Act 2023 help people? </strong></p><p>The Act provides consent-based personal data processing by digital platforms.</p>.<p>This means digital platforms will have to inform and get consent from people in English or any of the 22 Indian languages listed in the Constitution, in the language of their choice.</p>.<p>They will also have to notify their users of the online links using which they may exercise their rights for withdrawing their consent, obtaining information regarding processing their data, updating and erasure of their data, grievance redressal, nomination and making a complaint to the DPB.</p>.<p>The digital platform may also collect consent through consent managers, an independent digital platform operated by a different entity.</p>.<p><strong>Who are consent managers? </strong></p><p>The Reserve Bank of India (RBI) has created an account aggregator framework under which apps like Finvu, OneMoney, CAMS Finserv, etc, share financial information based on consent and for specific purposes.</p>.<p>The National Health Authority of India has also set up a Health Information Exchange that empowers citizens to securely access and share their health records, ensuring that data exchange is driven by informed consent. Such platforms may work as consent managers if they are approved by the DPB.</p>.<p><strong>Who are data fiduciaries? </strong></p><p>Entities such as social media platforms, e-commerce companies and online gaming platforms, etc, that collect and process an individual's personal data are data fiduciaries. They can use such data only after the individual's consent for specified purposes.</p>.<p>Digital platforms with a large number of users such as Facebook, Instagram, YouTube, Amazon, Flipkart, Netflix, etc, will qualify as significant data fiduciaries.</p>.<p><strong>Will the Act help in acting against spam calls? </strong></p><p>Yes. While the Telecom Regulatory Authority of India (TRAI) has issued rules for action on spam or pesky calls, citizens can take recourse under the DPDP Act 2023 as well. The DPB can impose a monetary penalty on entities found processing personal data, without consent, in violation of the Act.</p>.<p><strong>How can people file complaints? </strong></p><p>The DPB will function as a digital office. It will operate through a digital platform and app to enable citizens to approach it digitally and have their complaints adjudicated without their physical presence.</p>.<p>The government has prepared the entire digital framework, the digital platform, and the entire processes for this. </p><p><strong>What are the penalty provisions under the DPDP Act 2025? </strong></p><p>The draft rules do not elaborate on the penalty but spell out a mechanism to set up a DPB that will levy penalties based on the nature of the breach as listed in the DPDP Act 2023.</p>.<p>The DPDP Act 2023 has provisions to impose penalties of up to Rs 250 crore on data fiduciaries. The Act provides for graded financial penalties in case of violation of the Act and the rules.</p>.<p>The quantum of penalty will depend on the nature, gravity, duration, type, repetitiveness, efforts made to prevent a breach, etc. Further, significant data fiduciaries have higher obligations under the Act and rules, while a lower compliance burden is envisaged for startups.</p>.<p>Moreover, the data fiduciary may at any stage in the proceedings voluntarily give an undertaking to the Data Protection Board, which, if accepted, would result in the dropping of proceedings.</p>.<p>When will the rules be rolled out? The final rules will be placed before Parliament after the ongoing consultation process during the monsoon session. Thereafter, the government may take around two years to implement the DPDP Act 2023. All digital entities and consent managers will have time till then to check and put systems in place to comply with the Act.</p>.<p><strong>What are the exemptions? </strong></p><p>There are few exemptions from the provisions of the DPDP Act -- like performing judicial and regulatory functions under the law; enforcing legal rights and claims; preventing, detecting, investigating or prosecuting any offence; locating defaulters and their financial assets, etc.</p>.<p>There are some exemptions for certain data fiduciaries, including startups and performing research, etc.</p>.<p><strong>Will the DPDP Act 2023 be of help to people who do not have access to digital technologies? </strong></p><p>Yes. In case a person with no access to digital technology is impacted due to digital misuse of his personal data or details, the same recourse is available for that person as anyone who is digitally connected.</p>.<p>Under the DPDP Act 2023, the same recourse is available to both types of persons, irrespective of their access to digital technologies.</p>.<p><strong>What is the timeline for filing a complaint? </strong></p><p>There is no time limit for filing complaints under the DPDP Act 2023 as of now. </p>