In today’s fast-changing digital world, safeguarding personal data has become more critical than ever. Recognizing this need, India has introduced the draft Digital Personal Data Protection Rules, 2025, a landmark step towards creating a secure and transparent digital ecosystem. Rooted in the Digital Personal Data Protection Act, 2023, these draft rules are designed to protect individuals’ personal information while ensuring that organizations handle data responsibly. With a strong focus on transparency, accountability, and security, these draft rules aim to strike a balance between technological innovation and the fundamental right to privacy. Let’s delve into some key aspects of these rules:
Key Aspects of the Draft Rules:
1. Notice and Consent:
Entities handling personal data, known as Data Fiduciaries, are required to provide clear and standalone notices to individuals, called Data Principals, whose data is being processed. These notices must be easy to understand and separate from other information. They should clearly outline:
- The types of personal data being collected.
- The purpose for processing the data.
- How the processed data will enable specific goods, services, or uses.
Additionally, the notice must also include a link to the Data Fiduciary’s website or app. It should explain how Data Principals can withdraw consent, exercise their rights, or file complaints with the Data Protection Board.
2. Consent Managers:
The Consent Manager is a newly introduced role to assist individuals in managing their consent for data processing. These managers must be Indian companies with strong financial and operational capabilities, having a minimum net worth of ₹2 crore. They are required to operate a certified interoperable platform that enables Data Principals to give, review, manage, and withdraw consent. Consent Managers must maintain detailed records of consents and data sharing while providing transparent access to these records. They are also obligated to implement robust security measures and avoid any conflicts of interest with Data Fiduciaries.
3. Data Processing by the State:
The State and its instrumentalities can process personal data to provide subsidies, benefits, services, certificates, licenses, or permits. Such processing must follow strict standards to ensure it is lawful, transparent, and secure. The data collected must be limited to what is necessary, kept accurate, and retained only for as long as required.
4. Security Safeguards:
Data Fiduciaries must implement robust security measures to prevent data breaches. These include encryption, access controls, monitoring unauthorized access, and maintaining data backups. Contracts with Data Processors must also mandate strict security provisions to ensure data protection.
5. Data Breach Intimation:
If a personal data breach occurs, Data Fiduciaries must promptly inform affected Data Principals in a clear and concise manner. The notification should describe the breach, its potential consequences, mitigation measures, and safety recommendations to protect their data. Additionally, the Data Fiduciary must notify the Data Protection Board immediately and submit detailed information about the breach within 72 hours.
6. Data Retention:
Data Fiduciaries must delete personal data if a Data Principal has not interacted with them for a specified period, unless required by law. The duration for retaining data depends on the type of Fiduciary. They are also obligated to notify the Data Principal at least 48 hours before erasing their data.
7. Contact Information:
Every Data Fiduciary must provide contact details for a designated person, such as a Data Protection Officer, to address data processing queries. These details must be clearly displayed on their website or app and included in all responses to communications from Data Principals.
8. Processing of Children’s Data:
Data Fiduciaries must obtain verifiable parental consent before processing a child’s data and ensure the consenting individual is an adult. Certain entities, such as healthcare professionals, educational institutions, and childcare providers, are exempt from some provisions. These exemptions apply when processing is limited to essential activities like health services, education, safety monitoring, and transportation tracking, all aimed at ensuring the child’s well-being.
9. Significant Data Fiduciaries:
Significant Data Fiduciaries have extra responsibilities to ensure data protection. They must conduct annual Data Protection Impact Assessments and audits to evaluate compliance. Additionally, they must ensure their algorithmic software does not harm Data Principals’ rights and adhere to specific restrictions on transferring data across borders.
10. Rights of Data Principals:
Data Fiduciaries and Consent Managers must ensure Data Principals can easily exercise their rights, such as accessing or erasing their data. Additionally, Data Principals can nominate individuals to act on their behalf for these purposes.
11. Data Transfer Outside India:
Data Fiduciaries must comply with any requirements set by the Central Government for making personal data available to a foreign state or its entities.
12. Exemptions for Research:
The Act does not apply to the processing of personal data for research, archiving, or statistical purposes, provided it follows the standards specified in Schedule II.
13. Board Appointments:
The Central Government will appoint the Chairperson and other members of the Data Protection Board based on the recommendations of a Search-cum-Selection Committee.
14. Digital Office:
The Board and the Appellate Tribunal will function as digital offices, using technology to conduct proceedings without the need for physical presence of individuals.
15. Information Requests:
The Central Government can request information from Data Fiduciaries or intermediaries for various purposes, including national security or legal compliance.
Thus, the draft Digital Personal Data Protection Rules, 2025, will offer a robust framework to safeguard personal data in today’s digital era. Covering key aspects like consent, security, and transparency, these draft rules would empower individuals with greater control over their data. By familiarizing themselves with these provisions, both individuals and organizations can better navigate the digital landscape, ensuring privacy and security I n an increasingly data-driven world.
Disclaimer: This blog is for informational purposes only and does not constitute any legal advice. Readers should seek expert legal counsel before taking any action based on the content.