Why the draft personal data protection rules are contentious

Digital rights experts have flagged several gaps in the draft Digital Personal Data Protection Rules, 2025, released by the Union Ministry of Electronics and Information Technology on January 3.

They say that the rules, which aim to operationalise the Digital Personal Data Protection Act, 2023, passed by Parliament in August 2023, will struggle to follow the rule requiring parental consent to process children’s data given a lack of clarity. They also warned that the draft rules give too much power to the government. Moreover, there are significant gaps in the rules that could increase compliance costs for companies and harm users’ interests.

The act lays down guidelines for how the digital personal data of individuals should be processed by the state and by private entities.

Overview of the rules

The draft rules clarify how organisations processing personal data should handle that data, notify individuals of breaches of their data and ensure consent for data collection.

These organisations – which the act calls data fiduciaries – must provide clear notices to users that are easy to understand, explaining why they are collecting data and how it will be used. These notices must explain types of data being collected​​. Moreover, for users, withdrawing consent for their data to be used should be as simple as granting…

Read more