Syllabus: GS2/Polity and Governance
Context
- The Government of India has notified the Digital Personal Data Protection (DPDP) Rules, 2025, marking the full operationalisation of the Digital Personal Data Protection (DPDP) Act, 2023.
Key Highlights of the Rule
- Phased Implementation: The DPDP Rules introduce an 18-month phased compliance timeline, allowing organisations especially startups and smaller firms time to adapt.
- Consent Managers, responsible for helping individuals manage data permissions, must be Indian companies, ensuring domestic jurisdiction and accountability.
- Clear Protocols for Personal Data Breach Notifications: In the event of a personal data breach, Data Fiduciaries must promptly inform affected individuals regarding the nature of the breach, possible consequences & steps taken to mitigate harm.
- Safeguards for Children and Persons with Disabilities: Verifiable consent is mandatory before processing children’s personal data, with limited exemptions for essential sectors like education, healthcare, and real-time safety.
- Digital-First Data Protection Board (DPB): The DPB will function as a fully digital adjudicatory body, enabling online filing, tracking, and resolution of complaints.
- A dedicated digital platform and mobile app will increase transparency and ease of access.
- Transparency and Accountability Measures: Data Fiduciaries must display clear contact details (e.g., a designated officer or Data Protection Officer) for individuals to raise concerns.
| Timeline of the DPDP Act, 2023 – 2011: Group of experts on digital privacy law formed; report submitted in 2012. – 2017: IT ministry forms panel; report submitted in 2018. 1. The Supreme Court of India recognizes the right to privacy as a fundamental right in Justice KS Puttaswamy vs GOI. 2. Justice BN Srikrishna Committee is formed to draft data protection laws. – 2018-2021: Multiple drafts of the Personal Data Protection (PDP) Bill are introduced and revised, with the Joint Parliamentary Committee submitting a report in December 2021. – 2022: Bill withdrawn, fresh consultations proposed. – 2023: Digital Personal Data Protection Bill tabled, gets Parliament nod; to ensure data protection through rights-based governance. – 2025: Government introduces draft rules in January, releases final rules in November, 2025. |
Key Provisions of the DPDP Act, 2023
- Consent-Based Data Processing: Organizations need to obtain clear and informed consent from users before collecting their personal data.
- Data Minimization: Only necessary data should be collected, and it needs to be used solely for the stated purpose.
- Right to Erasure: Users can request deletion of their data, especially after prolonged inactivity.
- Data Retention Limits: Companies need to delete user data after three years of inactivity, with a 48-hour notice to the user.
- Cross-Border Data Transfer: The Act allows data transfers to certain countries, to be notified by the government.
- Penalties: Non-compliance can attract fines up to ₹250 crore, depending on the severity of the breach.
Related Controversies & Concerns
- Government Exemptions and Surveillance Powers: The rules grant broad exemptions to government agencies, allowing them to bypass consent requirements for reasons such as national security or public order.
- Impact on RTI and Transparency: The amendment to the RTI Act restricts access to personal data of public officials, undermining accountability and limiting public oversight.
- Compliance Burden on Businesses: The rules impose strict obligations on data fiduciaries, including mandatory data audits, breach notifications, and consent management systems.
- OTT platforms and entertainment apps, especially those targeting children, face increased costs due to requirements like parental consent and restrictions on behavioral tracking.
- Cross-Border Data Transfer Uncertainty: The rules allow data transfers to ‘trusted’ countries, but the criteria for trustworthiness are not defined.
- It could affect global tech firms and cloud service providers operating in India.
Source: TH
Previous article
150th Birth Anniversary of Birsa Munda
