Draft DPDP Rules: What They Mean for Data Protection in India

The Indian government has unveiled a draft version of the Digital Personal Data Protection (DPDP) Rules for public consultation, signaling a significant step in strengthening data privacy and cybersecurity. The proposed rules aim to operationalize the Digital Personal Data Protection Act, 2023, and impose stringent responsibilities on organizations handling personal data while empowering citizens with robust data rights.

Empowering Citizens with Data Rights

The draft rules emphasize transparency and accountability from data fiduciaries—entities responsible for processing personal data. According to a statement by India’s Press Information Bureau (PIB), fiduciaries must provide clear and accessible information about how personal data is processed, enabling individuals to give informed consent.

Citizens are equipped with critical rights under the DPDP Act, including:

Data Erasure: Individuals can demand the deletion of their data from digital platforms.
Digital Nominees: Users can appoint nominees to manage their digital rights in specific circumstances.
User-Friendly Mechanisms: Accessible tools are mandated for individuals to control their data effectively.

These measures seek to grant individuals greater control over their personal data while holding organizations accountable for its responsible use.

Stringent Security Measures for Organizations

Companies operating in India are required to implement robust security measures to protect personal data. These include:

Encryption and Access Control: Ensuring data confidentiality and limiting unauthorized access.
Data Backups: Safeguarding data integrity and availability.
Breach Detection Mechanisms: Proactively identifying and addressing security breaches.

In the event of a data breach, organizations must report detailed information about the incident to the Data Protection Board (DPB) within 72 hours. This report should include the sequence of events leading to the breach, mitigation steps taken, and, if known, the identity of the individuals responsible.

Key Provisions for Compliance

The DPDP Act introduces several additional compliance requirements for data fiduciaries, such as:

Data Retention: Personal data must be deleted after three years if no longer needed. Organizations must notify individuals 48 hours before erasing such data.
Data Protection Officer (DPO): Companies must display contact details of a designated DPO on their websites or apps to address users’ queries.
Parental Consent for Minors: Organizations must obtain verifiable consent from parents or legal guardians before processing the personal data of minors (under 18) or individuals with disabilities.
Data Protection Impact Assessments (DPIA): Significant data fiduciaries must conduct annual DPIAs and report findings to the DPB.
Cross-Border Data Transfers: Adherence to federal government guidelines for transferring specific categories of personal data outside India.

Safeguards for Government Data Processing

The draft rules extend to federal and state government agencies, requiring that their data processing activities adhere to lawful, transparent, and policy-aligned standards. These measures aim to ensure that government entities are held to the same rigorous standards as private organizations.

Organizations failing to safeguard personal data or notify the DPB of breaches face hefty penalties of up to ₹250 crore (approximately $30 million).

Feedback and Public Consultation

The Ministry of Electronics and Information Technology (MeitY) has invited public feedback on the draft regulations until February 18, 2025. To maintain confidentiality, submissions will not be disclosed to third parties. This participatory approach underscores the government’s commitment to creating a balanced framework that protects citizens’ data rights while fostering innovation.

Historical Context and Related Developments

The DPDP Act was officially passed in August 2023 after undergoing multiple revisions since its initial introduction in 2018. It followed a landmark 2017 ruling by India’s Supreme Court, which recognized privacy as a fundamental right under the Constitution. The Act represents India’s efforts to align with global data protection standards while addressing unique domestic challenges.

Complementing the DPDP Act, the Department of Telecommunications recently issued the Telecommunications (Telecom Cyber Security) Rules, 2024, to bolster the cybersecurity of communication networks. Key provisions include:

Incident Reporting: Telecom companies must report security incidents within six hours of detection and provide additional information within 24 hours.
Chief Telecommunication Security Officer (CTSO): Companies must appoint a CTSO who is an Indian citizen and resident.
Traffic Data Sharing: Telecom entities are required to share traffic data (excluding message content) with the federal government for cybersecurity purposes.

However, the Internet Freedom Foundation (IFF) has raised concerns over the vague definition of “traffic data,” warning it could lead to potential misuse. This highlights the need for clarity in framing regulations to balance security needs with privacy rights.

Implementation

To ensure effective implementation of the DPDP Rules, the following improvements and actions are recommended:

Enhanced Clarity on Cross-Border Data Transfers: The government should expedite the formation of specialized committees to define the categories of data restricted from leaving India.
Stronger Breach Response Protocols: Mandating periodic security drills and simulations can help organizations prepare for potential breaches.
Public Awareness Campaigns: Educating citizens about their rights and how to exercise them will enhance user engagement and compliance.
Streamlined Compliance Tools: Providing templates and automated tools for DPIAs and annual audits can reduce the compliance burden on smaller enterprises.

Conclusion

India’s proposed Digital Personal Data Protection Rules mark a pivotal step toward robust data governance, offering enhanced rights to individuals and imposing stringent obligations on organizations. By refining the framework and addressing stakeholder concerns, India can set a global benchmark for digital privacy and security while fostering a thriving digital economy.

Interesting Article : LDAPNightmare Exploit Targets Windows Servers with DoS and RCE

Draft DPDP Rules: What They Mean for Data Protection and Businesses in India