India’s digital future: A citizen-centric approach to data protection

‘When we talk about the global future, then human-centric approaches should be foremost.’ These words from Prime Minister Narendra Modi at the recent United Nations Summit of the Future reflect India’s vision of putting people first.

This philosophy has guided India’s efforts in shaping the draft Digital Personal Data Protection (DPDP) Rules, 2025. The rules, after being finalised, would operationalise the Digital Personal Data Protection Act, 2023, bringing to life India’s commitment to safeguarding citizens’ right to personal data protection. 

A new era of empowerment 

The Indian citizen lies at the heart of the DPDP Rules, 2025. In a world increasingly dominated by data, we believe it is imperative to place individuals at the heart of the governance framework. These rules empower citizens with rights such as informed consent, data erasure, and the ability to appoint digital nominees.
Citizens will no longer feel helpless in the face of breaches or unauthorised data usage. They will have tools to protect and manage their digital identities effectively. 

The rules are designed with simplicity and clarity, ensuring that every Indian, regardless of their technical knowhow, can understand and exercise their rights. From ensuring consent is sought in clear terms to mandating that information be provided to the citizens in English or any of the 22 Indian languages listed in the Constitution, the framework reflects the government’s commitment. From ensuring consent is sought in clear terms to mandating that information be provided to the citizens in English or any of the 22 Indian languages listed in the Constitution, the framework reflects the government’s commitment to inclusivity. 

Safeguarding children 

Children require special care in the digital age. Recognising this, the rules mandate verifiable parental or guardian consent for processing the personal data of minors. Additional safeguards ensure that children are shielded from exploitation, unauthorised profiling, and other digital harms. These provisions reflect the government’s dedication to creating a safer digital space for the future generation. 

India’s digital economy has been a global success story, and we are determined to keep this momentum alive. Our framework ensures personal data protection for the citizens while enabling innovation in the digital economy. Unlike some international models that lean heavily towards regulation, India’s approach is pragmatic and growth-oriented. This balance ensures that citizens are protected without stifling the innovative spirit that drives our startups and businesses. 

Small businesses and startups will face lower compliance burdens. The rules are designed with graded responsibilities, taking into account the varying capacities of stakeholders. Larger companies, based on assessment of data fiduciaries, will have higher obligations, ensuring accountability without disrupting growth. 

A digital-first philosophy 

At the core of these rules is a “digital by design” philosophy. The Data Protection Board, tasked with resolving grievances and enforcing compliance, will function predominantly as a digital office. By leveraging technology, we ensure efficiency, transparency, and speed. Citizens can file complaints, track progress, and seek resolutions without unnecessary physical interactions. 

This digital-first approach extends to consent mechanisms and data management workflows. By streamlining processes, we make it easier for fiduciaries to comply and for citizens to engage, fostering trust in the system. 

The journey to these rules has been as inclusive as their intent. Grounded in the principles of the Digital Personal Data Protection Act, 2023, the draft rules are a product of wide-ranging inputs gathered from various stakeholders and a study of global best practices. 

We have opened a 45-day public consultation period, inviting feedback and suggestions from citizens, businesses, and civil society. This engagement is a testament to our belief in collective wisdom and the importance of participatory policymaking while ensuring that the framework is not only robust but also adaptable to the unique challenges of our socio-economic landscape. 

To ensure citizens are aware of their rights and responsibilities, widespread awareness initiatives will be undertaken to educate the citizens about their rights regarding their personal data. 

As we unveil these rules, we are not merely addressing present challenges but laying the groundwork for a secure and innovative digital future. The Draft Digital Personal Data Protection Rules, 2025, reflect India’s leadership in shaping global data governance norms. By placing citizens at the centre and fostering a conducive environment for innovation, we are setting a precedent for the world to follow. 

Our commitment is clear: to protect, empower, and enable every Indian in this digital age. I encourage every citizen, business, and civil society group to participate in this dialogue by sharing comments and suggestions during the consultation period. Together, let us refine these rules to create a framework that truly represents the aspirations of a secure, inclusive, and thriving digital India. 

(The writer is the Union Minister for Electronics and Information Technology, Information & Broadcasting, and Railways)