India’s Ministry of Electronics and Information Technology (MeitY) on Saturday released draft rules in furtherance of the Digital Personal Data Protection (DPDP) Act, sparking significant debate regarding the rules’ implications on data privacy rights.

The Draft Digital Personal Data Protection Rules, 2025, which has been made available for public consultation until February 18, 2025, outlines critical provisions for how data fiduciaries should handle personal data.

The draft rules stipulate that data fiduciaries must obtain verifiable consent from parents before processing children’s personal data. This provision aims to enhance protections for minors but also places additional burdens on companies to ensure compliance with consent verification processes. Furthermore, the rules require that data be retained only as long as necessary and mandate its deletion upon withdrawal of consent. However, critics have noted that the vague language surrounding these requirements could lead to varied interpretations and inconsistent implementation across different sectors.

A notable aspect of the draft rules is the absence of specified penalties for violations, raising concerns among privacy advocates and industry stakeholders. Critics argue that the lack of punitive measures may undermine the effectiveness of the DPDP Act, which was designed to safeguard individuals’ personal data against misuse. They have further contended that without clear consequences, there is little incentive for compliance among organizations handling sensitive information.

Another contentious element of the draft rules is the proposed structure of the Data Protection Board (DPB), which oversees complaints and appeals related to data processing practices. While the government claims that these rules will facilitate a balance between regulation and innovation, there are concerns that they may not adequately address the complexities of digital data management in a rapidly evolving technological landscape.

The journey of the DPDP Act in India has been marked by extensive deliberation and multiple iterations. Initially proposed as the Personal Data Protection Bill, the legislation underwent five revisions before its final enactment on August 11, 2023. This landmark law emerged from a draft released by the Ministry of Electronics and Information Technology in November 2022 following public consultations that highlighted the need for a comprehensive framework to safeguard personal data. To facilitate the implementation of the DPDP Act, the MeitY has been drafting rules to implement the DPDP Act effectively.

The draft rules are expected to evolve based on feedback received during this consultation, with final regulations anticipated later this year. As public consultations proceed, rights advocates have emphasized that stakeholders must actively engage in the discussions to refine these rules and ensure they effectively protect individual rights while fostering a conducive environment for innovation.